Google pauses open-source bug bounty as AI hallucination reports overwhelm maintainers

Google has stopped accepting product vulnerability submissions through its Open Source Software Vulnerability Reward Program (OSS VRP), effective October 1, 2026. The change was reported by Chinese tech outlet IT之家 on October 4, 2026. According to the report, product vulnerabilities submitted before October 1, 2026, will not be affected, and vulnerabilities that may impact Google Cloud products through Google Cloud code repositories may still be accepted through the Cloud VRP.

OSS VRP is a dedicated security bounty program Google established to encourage independent security researchers to find and responsibly disclose security flaws across the company's open source ecosystem. Citing Tom's Hardware, the report says people familiar with the matter revealed that Google engineers and open source code maintainers had been overwhelmed by thousands of low-quality reports. These reports claimed to have discovered severe vulnerabilities, but upon deeper investigation, they turned out to be AI-generated “hallucinations” — invalid and impossible to exploit. The maintenance team had to spend significant effort verifying this false code, which severely cut into the time available for fixing real, high-severity vulnerabilities.

The rule change took effect on October 1, 2026. OSS VRP is no longer accepting new product vulnerability submissions. Previously submitted reports remain unaffected, and Google Cloud-related vulnerabilities may still be reported through the Cloud VRP.