Google Halts Open Source Bug Bounty Payouts After AI Report Flood

Google stopped accepting new submissions to its Open Source Software Vulnerability Reward Program on October 1, 2026, according to the program's rules page and a vendor post describing the change. TechCrunch reported the freeze followed a rise in automated and AI-generated vulnerability reports flooding the intake queue. Google says an update is coming in the first quarter of 2027, but the rules page does not say what that update will contain or whether the pause applies retroactively to reports filed just before the cutoff.

The program paid researchers for finding flaws in open source projects that Google maintains or depends on, a pipeline that security teams at companies using those same libraries have quietly relied on for years. Freelance bug hunters who treat OSS VRP submissions as income lose a channel overnight, with no stated date beyond a vague quarter. Maintainers lose a backstop that caught issues before they reached production code elsewhere. Nobody outside Google's security team has confirmed how many submissions triggered the freeze, or what share were judged low quality.

The mechanism is simple: a triage system built for human-paced submission volume got overwhelmed by tools that generate plausible-looking vulnerability reports faster than reviewers can validate them. That is a cost problem, not a security one. Each submission needs a human to read it, reproduce it, and decide if it is real before anyone gets paid. When submission volume outpaces reviewer capacity, the queue backs up and the program either hires more reviewers or stops the queue. Google chose the second option and gave itself until Q1 2027 to build something that can tell real reports from synthetic ones at scale.

For a security manager, the practical move now is to stop counting on Google's OSS VRP as a disclosure channel for anything urgent. Internal teams that discover flaws in Google-maintained open source code need another route, likely direct contact with maintainers or a different advisory process, because this one is closed. For a policy watcher, the freeze is worth tracking as an early data point on how automated report volume strains vulnerability disclosure programs generally, not just Google's. If other vendors face the same flood, more bounty programs may pause rather than scale up reviewer staff.

What Google has not disclosed is a volume threshold, a reviewer headcount, or criteria for distinguishing a useful automated report from noise. Those gaps matter because the Q1 2027 fix could mean anything from a new filtering tool to a stricter submission format to a permanent cap on report rate. Researchers who want clarity should ask Google's security team whether reports submitted October 1 or later will be reviewed once the program reopens, or discarded.

The freeze holds until Google says otherwise, sometime in the first quarter of 2027.