Google pauses OSS bug submissions after surge of invalid reports

Google announced on Oct. 1, 2026 that it is temporarily pausing product vulnerability submissions to its Open Source Software Vulnerability Reward Program (OSS VRP) following a sharp increase in automated reports, the company wrote on the program page and on X.

The pause applies only to product vulnerability reports submitted to the OSS VRP. Supply chain vulnerability reports and any reports already pending will continue to be processed, the update noted. Google added that product vulnerability reports submitted before Oct. 1, 2026 will still be handled.

Google asked researchers to submit eligible findings to other Google vulnerability programs when possible. For some repositories that affect Google Cloud products, reports may be accepted through the Cloud Vulnerability Reward Program. The company also encouraged participation in its Patch Rewards Program, which issues payments for proactive fixes to open source projects.

On the OSS VRP page, Google wrote: “This pause is due to a significant rise in automated submissions, the vast majority of which are not valid.” The company said it will revise parts of the OSS VRP and provide an update in the first quarter of 2027. “We will continue to reformat and work on this aspect of the OSS VRP and commit to giving an update in Q1 2027,” the post added.

The OSS VRP launched in 2022 to reward researchers who find vulnerabilities in Google’s open source projects. The pause follows changes Google made in May to other reward programs as automated tools became more widely used for discovery. In May, Google reduced standard Chrome payouts and began prioritizing concise reports with clear proof. Android rewards were refocused on vulnerability types that are harder for automated tools to find, and the top payout for a zero-click Pixel Titan M exploit with persistence was raised from $1 million to $1.5 million.

In March 2026, the Internet Bug Bounty program paused new submissions after a rise in AI-assisted vulnerability reports. Google’s update asks researchers affected by the OSS VRP pause to check Cloud VRP and Patch Rewards eligibility and to await the Q1 2027 update on the OSS VRP.