Cybersecurity
Google pauses OSS VRP flaw submissions
Google suspended product vulnerability submissions to its OSS Vulnerability Reward Program on 1 October after saying invalid AI-generated reports had flooded the process, and it plans an update in Q1 2027.
- Google suspended product vulnerability submissions to its Open Source Software Vulnerability Reward Program on 1 October.
- Google said the pause would not apply to submissions made before 1 October or to OSS VRP supply chain reports.
- Google said it may still accept some reports through Cloud VRP for some Google Cloud repositories.
- Google said it would provide an update by the first quarter of 2027.
Google suspended product vulnerability submissions to its OSS Vulnerability Reward Program on 1 October after saying the programme had been swamped by invalid reports generated with AI. In an official post on X, it said it would return with an update in the first quarter of 2027 while it reworked the scheme.
The pause did not apply to reports submitted before 1 October, and Google said OSS VRP supply chain reports were still in scope. It also said some product flaw reports could still come through Cloud VRP for certain Google Cloud repositories affecting Google Cloud products.
The article described OSS VRP as Google’s open-source bug bounty for defects in its public repositories. It said large language models and automated bug-hunting tools had cut the cost of producing reports, which had led to a rise in low-effort submissions.
The piece linked the decision to similar problems elsewhere in the sector. It said Linux maintainers had described being flooded by CVE findings after AI-driven bug hunters, and that Intel had suspended its bug bounty programme, although Intel had not confirmed AI-generated reports as the reason and experts suspected that explanation.
Named in this story
Companies
- suspended product vulnerability submissions to its OSS VRP
- Intel
- suspended its bug bounty programme
Products and systems
- Open Source Software Vulnerability Reward Program (OSS VRP)
- the bug bounty programme Google paused
- Cloud VRP
- may still accept some product vulnerability reports
- Linux
- was cited as a similar case involving false AI-generated reports
How the source tells it
The piece was mostly straight reporting, but it leaned on overload language and a wider industry-pattern frame to heighten the sense of strain.
- alarm It stressed overwhelm, floods of invalid reports and wasted review time to heighten concern.
- industry-wide strain It widened the story with comparisons to Linux and Intel and a claim that similar problems were spreading across the sector.
- speculation It treated the Intel explanation as an inference by experts rather than a confirmed reason.