Google Pauses Open-Source Product Bug Reports, Citing Invalid Automated Submissions

Security researchers can no longer submit new product-flaw reports to Google’s open-source bug bounty program. The pause took effect October 1, 2026. Google blamed a surge in automated submissions, saying most were invalid, according to TechCrunch. That closes one reporting route for flaws in Google’s publicly released code, rather than shutting down all of its security reward programs.

Finding flaws became a review burden

Launched in 2022, the Open Source Software Vulnerability Reward Program, or OSS VRP, pays researchers who privately report security weaknesses. Its projects include Go, Angular and Protocol Buffers, as Help Net Security explains. The program covers flaws in released code, along with repository settings and supply-chain components.

Product reports concern defects in the software itself: code errors, faulty logic or design problems. The program’s rules include issues that substantially affect the confidentiality or integrity of user data in software built with Google’s open-source code. Acceptance criteria vary by project tier and vulnerability category.

Tom’s Hardware reported that engineers and maintainers were overwhelmed by thousands of AI-generated reports describing invalid or unexploitable flaws. Reviewers spent time checking those claims instead of fixing genuine vulnerabilities.

This pause is due to a significant rise in automated submissions, the vast majority of which are not valid

Google, in a statement quoted by TechCrunch

The October 1 cutoff has exceptions

• Earlier submissions are unaffected. Product-vulnerability reports submitted before October 1 remain outside the suspension; the cutoff applies to new reports.
• Supply-chain reports remain open. Google has not suspended that part of OSS VRP, so the pause does not cover every category within the program.
• Some Cloud-related product flaws may still qualify elsewhere. Google may accept reports through its Cloud VRP for certain Google Cloud repositories when the vulnerabilities affect Cloud products.

An update, not a reopening date

For now, Google is directing researchers toward its other vulnerability reward programs. It also points to the Patch Rewards Program, which pays for security improvements to Google’s open-source projects. That offers a different route: rewards for improving security, rather than submitting a new product-flaw report to the paused channel.

Google says it will continue to reformat and work on the product-vulnerability part of OSS VRP, with an update promised in the first quarter of 2027. That commitment is to explain the next step, not to resume submissions on a specified date. The future format of the paused reporting channel remains unresolved.