Google halts open-source bug bounty program amid AI spam surge

Google has suspended new product vulnerability submissions to its Open Source Software Vulnerability Reward Program (OSS VRP), effective October 1, 2026. The pause follows a surge of invalid, AI-generated reports that overwhelmed the engineers and open-source maintainers who review them. Google has not said when submissions will reopen.