Google pauses open-source vulnerability bounty program, citing significant increase in AI automated submissions

AI Brief

Google pauses its open-source software vulnerability bounty program (OSS VRP) from October 1, due to a significant increase in AI automated submissions, with the vast majority of reports being invalid. The company promises to provide an update in the first quarter of 2027, and during this period recommends participants switch to its other vulnerability bounty programs; according to Tom'Tom's Hardware, engineers and open-source maintainers are flooded with invalid or model-hallucination reports.

Site analysis / see how to judge

As AI reports more vulnerabilities, how can you encourage maintainers to read your reports?

Google VRP’s original notice pauses new OSS VRP product-vulnerability submissions, explicitly excluding supply-chain and outstanding reports, with an update promised in Q1 2027.

Reading Analysis

Return to original text

A short introduction is retained here; the full text from the source website is not reposted. For specific wording and subsequent updates, please refer to the original article.

Open AIHOT original