Flooded by Automated Bug Reports, Google Puts Its Open-Source Bounty on Hold
Google has stopped taking product vulnerability reports for its open-source bounty program after a surge of automated submissions, most of them invalid. Here is the story and why it matters.
Bug bounty programs run on a simple bargain: outside researchers find real security holes, and the software maker pays for the tip. That bargain only works if the reports are worth reading. Google says too many of the reports reaching one of its programs no longer are, so it has hit pause.
A program built for the software supply chain
Google launched its Open Source Software Vulnerability Rewards Program, or OSS VRP, in August 2022. It rewarded researchers with $100 to $31,337 for responsibly reporting flaws in open-source projects Google maintains, such as Golang, Angular, Bazel, Protocol Buffers and Fuchsia, as well as critical third-party dependencies. Repository settings, including GitHub Actions, application configurations and access control rules, were also in scope. From the beginning, the focus was on bugs with the biggest potential impact on the software supply chain.
What changed
Google now says it is temporarily not accepting OSS VRP product vulnerability submissions. Its explanation was blunt: a significant rise in automated submissions, the vast majority of which are not valid. BleepingComputer describes the flood as AI-generated reports. The pause does not apply to supply chain reports, to reports already in the queue, or to product vulnerabilities submitted before October 1, 2026.
Researchers still have other routes. Security patches for open-source software can go through Google’s Patch Rewards Program, which pays up to $15,000 for high-impact fixes, and flaws in Google Cloud open-source repositories that affect Cloud products can be reported through the Cloud VRP. Google says it is reworking the OSS program and has committed to an update in the first quarter of 2027.
Part of a wider pattern
Google has paid more than $81.6 million to researchers since its first rewards program in 2010, including a record $17.1 million to more than 700 researchers in 2025, up 40% from $12 million in 2024. That scale makes the pause notable, but Google is not alone:
- In January, the maintainer of curl ended the project’s HackerOne bug bounty after being buried in low-quality AI-generated reports.
- In mid-September, Intel removed all financial rewards from its Intigriti bug bounty program, without explaining why.
- Microsoft has not paused anything, but warned in May that AI tools are surfacing far more vulnerabilities and that the faster pace of discovery “can raise operational demands.” Last month it shipped fixes for a record 966 flaws, two of them actively exploited zero-days.
Sergiu Gatlan covered the pause for BleepingComputer, including Google’s statement and the earlier moves by curl and Intel.
What this means for your company
- Expect bigger patch cycles. Whether reports come from people or AI tools, more real vulnerabilities are being found. Monthly updates are likely to keep growing, so a dependable, tested patch routine is no longer optional.
- If you invite outside reports, plan for volume. Companies with a security contact page or disclosure policy should decide in advance how to triage reports and what evidence they require.
- Know your open-source dependencies. Much of the software your business runs is built on open-source components. Keep an inventory so you can act quickly when one of them is patched.
Need help building a patch and vulnerability management routine that keeps up? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.
About The Author
