Google has temporarily suspended submissions for product vulnerabilities to its Open Source Software Vulnerability Rewards Program (OSS VRP), effective October 1, 2026. The company cited a significant increase in automated submissions, most of which were deemed invalid, as the reason for the pause.
The OSS VRP, launched in August 2022, offers rewards ranging from $100 to $31,337 for the responsible disclosure of security flaws in Google-maintained open-source projects such as Golang, Angular, Bazel, Protocol Buffers, and Fuchsia, as well as critical third-party dependencies and repository settings like GitHub actions and access control rules. The program's focus has been on vulnerabilities with the most substantial impact on the software supply chain.
Despite the suspension of product vulnerability submissions, the OSS VRP continues to accept supply chain reports, and all outstanding reports submitted before October 1, 2026, remain unaffected. Google has indicated that it is working to reformat the program to address the issues with automated submissions and plans to provide an update in the first quarter of 2027.
Security researchers are still encouraged to submit security patches for open-source software through the Google Patch Rewards Program, which offers bounties up to $15,000 for high-impact fixes. Additionally, vulnerabilities in Google Cloud open-source repositories that affect Cloud products can still be reported via the company's Cloud VRP.
Since establishing its first VRP in 2010, Google has awarded over $81.6 million to thousands of security researchers. In 2025, the company distributed a record $17.1 million to more than 700 researchers, marking a 40% increase from the $12 million awarded in 2024.
Google is not the only entity to face challenges with bug bounty programs due to an influx of low-quality, potentially AI-generated reports. In January, the maintainer of the curl command-line utility and library terminated its HackerOne security bug bounty program after being overwhelmed by such submissions. More recently, in mid-September, Intel removed all financial rewards for security flaws reported through its Intigriti bug bounty program, though it has not yet provided an explanation for this decision.
Microsoft also noted in May that AI tools are contributing to a faster and broader discovery of vulnerabilities across the software industry, which could increase operational demands for security teams. Last month, Microsoft released patches for 966 flaws, including two actively exploited zero-day vulnerabilities.
