OSS VRP (Product): news timeline & CVEs

Google Pauses OSS Product Bug Bounty Rewards After Surge in Invalid Automated Reports

Google paused paid product-vulnerability reports for its open-source bug bounty after a surge of invalid automated submissions.

Google stopped accepting paid product-vulnerability reports under its Open Source Software Vulnerability Reward Program effective October 1, 2026, citing a surge of mostly invalid automated submissions. Projects including Go, Angular, Flutter, Bazel, and Protocol Buffers no longer list product-vulnerability rewards, previously up to $7,500 for flagship projects. Supply-chain compromise reports remain rewarded, and reports filed before October 1 are unaffected. Google said it will update the program in the first quarter of 2027 and gave no date for resuming product reports.

The Hacker Newsupdated Oct 6, 10:10 UTC · 2d agofirst Oct 6, 09:21 UTC · 2d agoIndustry 10 sources1

Google pauses open source bug bounty program after rise in AI submissions

Google paused its open-source bug bounty after invalid, mostly automated AI submissions overwhelmed reviewers.

Google temporarily stopped accepting reports to its open-source vulnerability reward program, OSS VRP, citing a surge of automated submissions that were largely invalid. Malwarebytes notes similar pressure earlier in 2026, when curl ended its HackerOne bounty and Intel's Intigriti program reportedly dropped payouts amid AI-generated reports. The pause is meant to let Google add controls such as proof-of-concept requirements and rate limits, with an update promised in the first quarter of 2027.

Malwarebytes Labsupdated Oct 6, 10:10 UTC · 2d agofirst Oct 5, 15:00 UTC · 3d agoIndustry 10 sources1

Google Narrows Open Source Bug Bounty Amid Wave of Invalid Automated Reports

Google paused product-vulnerability submissions to its open-source bug bounty after a surge of invalid automated reports.

Google temporarily closed its Open Source Software Vulnerability Reward Program to new product vulnerability submissions, citing a surge of automated reports that are mostly invalid. The pause, announced on October 1, 2026, does not affect supply-chain reports, pending reports, or submissions made before that date. Some Google Cloud repository issues may still be reported through the Cloud VRP, and researchers can use the Patch Rewards Program. Google said it will update the OSS VRP in Q1 2027, after earlier 2026 changes to Chrome and Android bounties in response to AI-assisted vulnerability discovery.

SecurityWeekupdated Oct 6, 10:10 UTC · 2d agofirst Oct 5, 14:26 UTC · 3d agoIndustry 10 sources1

Google Pauses Open-Source Bug Bounty Program After Flood of Invalid AI-Generated Reports

Google paused new OSS VRP product reports after a flood of mostly invalid AI-generated submissions.

Google stopped accepting new product vulnerability reports in its Open Source Software Vulnerability Reward Program on October 1, 2026, after a sharp rise in automated submissions that mostly failed validation. Supply-chain reports remain eligible, reports filed before the cutoff will still be handled, and some Google Cloud repository issues can go to the separate Cloud VRP. Google said AI-written reports often invent exploit paths, wrong trigger conditions, or unreachable bugs and create a heavy triage burden. It expects to update the program in the first quarter of 2027; flagship OT0 supply-chain rewards still range from $3,133.7 to $31,337.

Cyber Security Newsupdated Oct 6, 10:10 UTC · 2d agofirst Oct 5, 11:44 UTC · 3d agoIndustry 10 sources1

Google Tightens Open-Source Bug Bounty Rules After Surge in AI-Generated Vulnerability Reports

Google paused new OSS VRP product-vulnerability reports after a surge of invalid AI-generated submissions.

Google stopped accepting new product-vulnerability reports in its Open Source Software Vulnerability Reward Program on October 1, 2026, after a surge of mostly invalid automated and AI-assisted submissions. Reports filed before that date continue through normal triage, and OSS supply-chain compromise reporting remains open. Researchers are directed to Google Cloud VRP, Google AI VRP, or the Patch Rewards Program depending on impact. Google said it will update this part of the program in the first quarter of 2027.

GBHackersupdated Oct 6, 10:10 UTC · 2d agofirst Oct 5, 09:52 UTC · 3d agoIndustry 10 sources1

Google halts open-source bug bounty program amid AI spam surge

Google paused OSS Vulnerability Rewards submissions after a surge of invalid AI-generated bug reports.

Google temporarily stopped accepting product-vulnerability submissions to its Open Source Software Vulnerability Rewards Program after a surge of automated, mostly invalid AI-generated reports. Supply-chain reports, outstanding tickets, the Patch Rewards Program offering up to $15,000, and Cloud VRP remain available. Google said submissions before October 1, 2026 are unaffected and promised a program update in Q1 2027. Curl previously ended its HackerOne bounty over AI-slop reports, and Intel removed Intigriti financial rewards in September.

BleepingComputerupdated Oct 6, 10:10 UTC · 2d agofirst Oct 5, 08:27 UTC · 3d agoIndustry 10 sources1

OSS VRP

Timeline6 articles

Appears with