Google Temporarily Pauses Some Reports in OSS VRP

Google OSS VRP is temporarily not accepting new product vulnerability reports as of October 1, 2026. The change affects the Open Source Software Vulnerability Reward Program, a rewards system for security flaws in the affected Google open-source projects. The company cited a significant increase in automated submissions, most of which are invalid.

This is not a complete end to the bug bounty program, nor an announcement of an actively exploited vulnerability. Google has paused only the acceptance of product reports in OSS VRP. Cases submitted before October 1 remain in the program, and the restriction does not apply to supply-chain compromise reports.

What is changing in Google OSS VRP

Researchers currently cannot submit new product bugs through OSS VRP within the scope covered by this part of the program. Google’s rules state that it will publish an update on the operation of this branch of the program in the first quarter of 2027.

However, the announcement does not set a date for resuming acceptance of product vulnerabilities. The promise of an update in the first quarter of 2027 therefore cannot be understood as confirmation that the channel will reopen at that time.

An exception applies to supply-chain compromise reports. The program may continue accepting such cases. Product reports submitted by researchers before the change was introduced remain in the program.

Automated reports strained triage

Google said the problem is the large volume of automated reports, most of which are invalid. The influx of faulty or insufficiently supported submissions may therefore limit the capacity to process legitimate findings.

In March 2026, the company already warned about an increase in AI-generated reports and tightened evidence requirements for some submissions. The current statement, however, refers generally to automated reports. Google did not directly confirm that all or most of the submissions leading to the current pause were created by artificial intelligence.

Automation may include various tools and processes, while the March announcement specifically addressed the increase in AI-generated reports. The available information does not indicate that Google was describing a cyber campaign or a specific attack on open-source projects.

What security researchers should watch

Google is expected to announce how the affected part of OSS VRP will operate in the first quarter of 2027. Until then, it will be important to see whether the company introduces more precise requirements for reproduction steps, author-reputation-based filters, or other report-quality checks.

According to the available information, Google is also directing researchers to other relevant programs, including Cloud VRP and the Patch Rewards Program. It has not yet been confirmed whether, or how, the routing of individual types of reports between these programs will change.

For researchers with a new product vulnerability in the affected open-source projects, it is therefore important to check the current rules of the specific program before submitting a report. For supply-chain-related cases and reports already submitted, the temporary OSS VRP restriction does not apply.

Verified and updated: 10/06/2026 3:22 PM