Google has temporarily stopped accepting a class of vulnerability submissions to its Open Source Software Vulnerability Rewards Program after a surge of automated reports overwhelmed the program with low-quality findings.
The pause is an important example of AI’s effect on security work: automation can increase the number of potential vulnerabilities researchers surface, but it can also overwhelm human triage when generated reports are not carefully validated.
Google had already tightened the OSS VRP because of AI-generated reports
Earlier in 2026, Google said its open-source security program was seeing a major increase in AI-generated submissions that contained hallucinated exploit scenarios or identified coding issues with little real security impact. In a March rules update, the company raised evidence requirements for some vulnerability classes and reduced rewards for lower-priority projects.
Google’s OSS VRP covers major open-source projects maintained by the company, including Go, Angular, Bazel and Fuchsia, as well as supply-chain weaknesses and credential exposures.
The problem is verification, not simply AI use
AI can be genuinely useful to security researchers. Models can review source code, generate test cases, explain unfamiliar components and help prioritize suspicious code paths. The problem begins when automated systems submit findings faster than researchers verify whether those findings are exploitable.
A plausible-looking report can consume substantial triage time even when the underlying issue cannot be reached in practice or does not cross a meaningful security boundary. When thousands of such reports arrive, they can crowd out the genuinely dangerous vulnerabilities a bounty program is designed to surface.
Bug bounty economics are changing
Traditional vulnerability-reward programs assume that creating a detailed report requires enough human effort to limit submission volume. AI changes that assumption. A researcher can now generate far more candidate findings, descriptions and proof-of-concept ideas than before.
That pushes programs toward stronger proof requirements. Reproduction steps, working test cases, merged patches and clear demonstrations of security impact become more important when narrative quality alone is easy to automate.
The same pressure will spread beyond Google
Maintainers of open-source projects are likely to face similar problems as code-capable models improve. Automated scanners already generate noise; generative systems add convincing explanations that can make weak findings look more credible than traditional static-analysis alerts.
The long-term solution is unlikely to be banning AI from security research. Instead, vulnerability programs may increasingly reward verified impact rather than report volume, require machine-generated findings to be disclosed and use their own automated systems to filter submissions before human review.
Google’s pause is therefore more than a program-management decision. It is an early warning about how security institutions must adapt when the cost of producing plausible vulnerability reports approaches zero.
Source and verification note
The primary supporting record for this report is Google’s OSS VRP rules. The October 1 pause applies to new product-vulnerability submissions. Previously filed submissions and supply-chain reports are not covered by the same suspension. Google committed to an update in Q1 2027, not a guaranteed restart date.
