Google freezes open-source bug bounty program amid flood of invalid AI slop submissions
Google suspends product vulnerability submissions to its Open Source Software Vulnerability Reward Program (OSS VRP) over an influx of invalid AI-driven reports.
Google has temporarily halted its Open Source Software Vulnerability Reward Program (OSS VRP) due to a massive surge in invalid bug reports generated by artificial intelligence. The company announced the suspension on X on October 1, urging participants to explore other VRP programs and promising to provide an update by the first quarter of 2027.
The issue arose as large language models and automated AI bug-hunting scripts made it incredibly easy for anyone to submit low-effort, AI-generated bug reports, overwhelming Google's engineers and open-source maintainers. Previously, the program required significant manual effort for researchers to find and disclose security flaws across Google's open-source ecosystem.
The suspension does not affect product vulnerabilities reported before October 1 or reports submitted through the Cloud VRP or the OSS VRP's supply chain reports. This decision follows similar suspensions by other companies, like Linux, which ended support for older network drivers due to an influx of false AI-generated bug reports.
Written by urgent.news from Tom's Hardware's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
