Cybersecurity
Google suspends OSS VRP submissions
Google temporarily stopped new product vulnerability submissions to its open-source rewards programme after a rise in automated reports, while other report types and existing cases remained open.
- Google said it had temporarily stopped accepting OSS VRP product vulnerability submissions because automated reports had risen and most were not valid.
- Google said the pause did not affect OSS VRP supply-chain reports or reports already outstanding.
- Google said researchers could still submit patches through the Google Patch Rewards Program and report issues in Google Cloud open-source repositories through Cloud VRP.
- Google launched OSS VRP in August 2022 with rewards from $100 to $31,337 and said it would focus on high-impact software supply-chain flaws.
- The article said curl, Intel and Microsoft had also faced or warned about a rise in AI-generated vulnerability reports and related operational pressure.
Google said it had temporarily stopped taking product vulnerability submissions to its Open Source Software Vulnerability Rewards Program after a sharp rise in automated reports. The company said most of those submissions were not valid, and it said supply-chain reports and outstanding reports were unaffected.
Google said researchers could still send security patches through the Google Patch Rewards Program and report vulnerabilities in Google Cloud open-source repositories through Cloud VRP. It said it was working on changes to the OSS VRP and would provide an update in Q1 2027.
Google launched OSS VRP in August 2022 with rewards from $100 to $31,337. It said the programme would focus on security flaws with the greatest effect on the software supply chain, and it later said it had paid more than $81.6 million to security researchers since 2010, including $17.1 million in 2025 to more than 700 researchers.
The article said other organisations had also changed bug bounty arrangements after AI-generated reports increased. It said the curl maintainer ended its HackerOne programme in January, Intel removed financial rewards from its Intigriti programme in mid-September, and Microsoft warned in May that AI tools would increase vulnerability discovery and operational demands.
Named in this story
Companies
- suspended OSS VRP submissions and said it was revising the programme
- HackerOne
- platform used for curl’s bug bounty programme
- Intel
- removed financial rewards from its Intigriti bounty programme
- Intigriti
- platform used for Intel’s bug bounty programme
- Microsoft
- warned that AI tools were increasing vulnerability discovery and later patched 966 flaws in a month
Products and systems
- Open Source Software Vulnerability Rewards Program
- Google’s open-source bug bounty programme, which was paused for product vulnerability submissions
- Google Patch Rewards Program
- alternative programme for submitting security patches
- Cloud VRP
- Google’s channel for reporting vulnerabilities in Google Cloud open-source repositories
- curl
- project whose maintainer ended its HackerOne bounty programme
How the source tells it
The piece was mostly straight reporting, but it used repeated flood-and-onslaught language to cast the automated-submissions problem as urgent.
- alarm repeated flood and onslaught wording around automated reports
- hype superlative phrasing used for payout totals and patch counts