Google has paused product vulnerability submissions to its open-source bug bounty program after a surge in automated reports overwhelmed the process.

The Open Source Software Vulnerability Reward Program, or OSS VRP, rewards security researchers for finding and reporting vulnerabilities in Google's open-source software. The program covers Google-owned open-source repositories and pays researchers for qualifying security findings.

Why Google Paused The Program

On Thursday, Google Bug Hunters posted on X that it was "temporarily" no longer accepting OSS VRP product vulnerability submissions, while noting that supply chain reports and outstanding reports were not affected.

Google said the pause was caused by a "significant rise in automated submissions," with the "vast majority" not valid. The company said it plans to rework the program and provide an update in the first quarter of 2027.

Google had already tightened its OSS VRP rules earlier this year after reporting a surge in AI-generated submissions, including reports containing incorrect information or vulnerabilities that had little security impact.

The development comes as AI-assisted security testing increasingly accelerates vulnerability discovery. In May, Anthropic said its Project Glasswing had uncovered more than 10,000 high- or critical-severity vulnerabilities, while warning that handling the growing volume of findings was becoming a major industry challenge.

AI Changes Bug Hunting

AI is also being used by researchers in legitimate bug hunting. In September, independent researchers used Anthropic's Claude to identify vulnerabilities affecting OpenAI, reporting the findings through the company's bug-hunting program and receiving a $6,500 bounty.

Google said researchers can instead submit findings through its other vulnerability reward programs or pursue its Patch Rewards Program while the OSS VRP is being reworked.