Google Pauses New Product Vulnerability Reports to Its Open-Source Bug Bounty
Summary
Google paused new product vulnerability submissions to its OSS Vulnerability Reward Program from October 1, 2026, after a surge of mostly invalid automated reports. Earlier submissions remain valid; Google plans an update in Q1 2027.
Key points
- Google stopped accepting new product vulnerability reports through its Open Source Software Vulnerability Reward Program (OSS VRP) on October 1, 2026.
- Google cited a significant rise in automated submissions, most of which it said were invalid.
- Reports submitted before October 1 remain eligible.
- Some vulnerabilities in Google Cloud repositories may still be reportable through the Cloud VRP if they affect Cloud products.
- Researchers are directed to other reward programs or Google's Patch Rewards Program.
- Google plans to provide an update on the OSS VRP in Q1 2027.
Article Details
- Event Type
- Google paused acceptance of new product vulnerability reports through its Open Source Software Vulnerability Reward Program (OSS VRP) after a surge of invalid, AI-generated submissions.
- Impact
- New product vulnerability reports are no longer accepted through the OSS VRP as of October 1, 2026. Reports submitted before that date remain valid. Some vulnerabilities in Google Cloud repositories that affect Cloud products may still be reportable through Cloud VRP.