Google Halts OSS VRP Vulnerability Submissions Amid AI-Generated Report Surge

The suspension highlights the growing challenges of managing AI-generated content in cybersecurity.

• Google paused new product vulnerability submissions to its Open Source Software Vulnerability Rewards Program (OSS VRP) effective October 1, 2026.
• The company cited a surge in invalid, AI-generated reports overwhelming human reviewers.
• Existing submissions and other Google bug bounty programs remain unaffected, with updates expected in Q1 2027.

• AI-generated reports have surged due to the proliferation of large language models, leading to a flood of low-quality submissions.
• Cybersecurity experts had previously warned about the risks of automated spam overwhelming triage processes in bug bounty programs.
• Google tightened submission requirements earlier in 2026 in response to rising automated reports, but the situation has escalated.

On October 1, 2026, Google announced a significant pause in accepting new product vulnerability submissions to its OSS VRP. This decision was driven by a dramatic increase in automated, AI-generated reports, which were largely invalid or contained inaccuracies—often referred to as "hallucinations." The influx of these low-quality submissions overwhelmed the human reviewers responsible for assessing the validity of reports and maintaining the integrity of Google's open-source projects.

The OSS VRP is a critical component of Google's approach to securing its open-source software, incentivizing researchers to identify and report vulnerabilities. However, the recent surge in AI-generated reports has raised concerns about the effectiveness of this program. Google has indicated that the vast majority of these automated submissions were not valid, prompting the company to take action to protect the quality of its vulnerability reporting process.

This pause affects only new product vulnerability reports; submissions made before October 1 and supply chain reports will continue to be processed. Google has directed researchers to alternative programs, such as the Cloud VRP or Patch Rewards, to ensure that valid reports can still be submitted and addressed. The company has committed to reforming the OSS VRP and plans to provide an update in Q1 2027.

The challenges posed by AI-generated content are not unique to Google. Similar strains have been observed in other open-source communities, such as curl and Linux kernel reviews, where the influx of low-quality submissions has also raised alarms. As the cybersecurity landscape evolves, the need for effective AI filters and improved submission processes becomes increasingly critical.

The implications of this pause extend beyond Google. As organizations increasingly rely on open-source software, the integrity of vulnerability reporting becomes paramount. If automated submissions continue to flood these systems, it could lead to a backlog of valid reports, ultimately compromising security efforts across the board.

• Security researchers: Limited avenues for reporting vulnerabilities may hinder their ability to contribute effectively.
• Open-source maintainers: Increased workload due to the need to sift through existing submissions and manage the quality of reports.
• Tech companies: Organizations relying on Google's open-source projects may face security risks if vulnerabilities go unreported or unresolved.

• Program reforms: Watch for updates from Google in Q1 2027 regarding changes to the OSS VRP and how they plan to address the influx of AI-generated reports.
• AI filter development: Monitor advancements in AI filtering technologies that could help distinguish valid reports from automated noise.
• Community responses: Observe how other open-source communities adapt to similar challenges and whether they implement their own suspensions or reforms.