Google stopped accepting new product-vulnerability reports through its open-source rewards program, citing a rise in automated submissions that were mostly invalid.
Google has paused new product-vulnerability submissions to its Open Source Software Vulnerability Reward Program (OSS VRP), citing a significant rise in automated reports, most of which it said were invalid. The pause took effect on October 1, 2026, and the company said it would provide an update in the first quarter of 2027 as it revises this part of the program.
The change affects product-vulnerability reports submitted through the open-source program. Google said reports filed before the cutoff are not affected and indicated that some relevant reports may still be accepted through other channels, including its Cloud Vulnerability Reward Program. It also directed researchers to other reward programs or its Patch Rewards Program while the OSS VRP is being reworked.
The decision highlights a security-triage problem created by a sharp rise in low-quality automated submissions: generating reports can be inexpensive, but investigating and validating them still consumes human time. In the company’s statement, Google attributed the pause to the volume and low validity of submissions, rather than announcing a change to its process for handling already-filed reports.
For vulnerability researchers, the immediate practical effect is that this reporting route is unavailable for new product issues until Google changes or reopens it. Security teams and open-source maintainers may also need to account for shifting disclosure channels as organizations adjust their programs to handle automated reports. Google has not yet described the redesigned process, how it will distinguish useful reports from noise, or whether the pause will end after the next update.
The development is a notable operational response by a major technology company to AI-associated reporting pressure. It does not mean that all AI-assisted vulnerability research is invalid, nor that vulnerability reporting has stopped across Google’s other programs. The company’s Q1 2027 update should clarify whether it will introduce new submission controls, change eligibility rules or resume the affected intake process.