Google suspends product bugs in its open source bug bounty

The rules page of the Google Open Source Software Vulnerability Reward Program says it in a single line: as of October 1, 2026, product vulnerability reports are no longer accepted. The only exception covers certain Google Cloud repositories that affect Google Cloud products, for which reports can still go through the Cloud VRP. On October 1 the @GoogleVRP account on X clarified that the change does not affect supply chain reports or reports already submitted and still open, and invited researchers to turn their attention to the company's other VRP programs. The full reward scale for supply chain compromise remains in place: up to $31,337 for OT0 (Flagship) projects, $13,337 for OT1, $3,133.70 for OT2, and no cash for OT3.

The thing worth noting is that the official page doesn't say why. It announces the suspension, commits to keep reviewing this part of the program and sets a date in the first quarter of 2027. The reason has to be looked for elsewhere, and the document that comes closest is the Google Bug Hunters blog post on the 2026 rules revision: there the company reported a sharp rise in low-quality or invalid reports, including "AI-generated reports that contain incorrect information or 'hallucinations' about how a vulnerability might be triggered". That same revision introduced the OT0–OT3 project tiers, required top-tier projects to provide an exact reproduction with OSS-Fuzz or an already accepted patch for memory corruption reports, and ended cash rewards for product vulnerabilities in tiers OT2 and OT3. Tom's Hardware and other outlets link the October suspension to that same wave of AI-generated reports.

So the connection is plausible but indirect: in March Google described the problem, in October it closed the category, and the rules page draws no line between the two. Google has published no numbers: not how many reports come in, not what share is invalid, not how many of the invalid ones were produced with a model. A sentence attributed to the company about a sharp rise in automated submissions, the vast majority of them invalid, is also circulating: I couldn't verify it in a full text, because the post on X requires a login, so I'm keeping it out of the tally of facts. It's worth remembering that this context exists beyond Google too: in 2026 the curl project shut down its own bug bounty, and the pressure on open source maintainers is not a problem that started in Mountain View.

What strikes me is the shape of the decision: declared provisional, with an update promised by the first quarter of 2027. Google presents it as temporary, but doesn't say what will come of it. In the meantime, though, apart from the Google Cloud repositories exception, the channel is closed to those who find these vulnerabilities by hand, and for the coming months we'll only know what Google chooses to tell: with no public numbers, the only way to judge whether the suspension worked will be to read the update Google has promised for the first quarter of 2027.

— Olya