Google temporarily suspended its Open Source Software Vulnerability Rewards Program (구글 오픈소스 소프트웨어 취약점 보상 프로그램) starting October 1. The program rewards researchers who find and report vulnerabilities in Google’s open-source software. Google cited a “significant increase” in automated submissions as the reason for the suspension, saying most were invalid. The company said it would provide its next update on the program in the first quarter of 2027, but did not announce an exact restart date.

Background and context

Vulnerability rewards programs offer incentives to outside researchers to find and report security issues in software. Reports that identify real vulnerabilities can help verify and address security problems, but invalid reports or those containing false information can increase the burden on reviewers.

According to Tom’s Hardware, Google engineers and open-source maintainers were overwhelmed by reports that were invalid or contained hallucinations—plausible-sounding but false information. Google’s stated reason for the suspension was an increase in automated submissions and their low validity rate. The coverage linked the issue to AI-generated submissions, but the share of automated reports generated by AI has not been disclosed.

TechCrunch reported that cybersecurity experts warned last year that low-quality, AI-generated content could pose a serious risk to bug bounty programs. The suspension shows that as automated submissions increase, a program’s ability to review them and determine whether they are genuine can be just as important to its operation as the number of reports it receives.

What this news means

The people directly affected are researchers who planned to report vulnerabilities through Google’s program. While the program is paused, reporting and reward activity through this channel may be disrupted. Google recommended that participants consider its other bug bounty programs.

Report quality also matters to reviewers and open-source maintainers. If a large number of invalid reports pile up, more review may be needed to identify reports of genuine vulnerabilities, which could affect the program’s ability to serve as a channel for discovering vulnerabilities. However, Google has only said that automated submissions increased and that most were invalid; it has not been confirmed how much this delayed actual security responses.

For example, if a researcher believes they have found a vulnerability in Google’s open-source software, they should first check whether the program is still paused and review the other bug bounty programs Google has recommended. However, information about the scope or requirements for submissions to each program is not included in the confirmed details here.

What is confirmed and what remains unknown

Confirmed facts

  • Google temporarily suspended its open-source software vulnerability rewards program starting October 1.
  • Google said automated submissions had increased substantially and that most were invalid.
  • Tom’s Hardware reported that Google engineers and open-source maintainers were overwhelmed by reports that were invalid or contained hallucinations.
  • Google said it would provide an update on the program in the first quarter of 2027 and recommended that participants consider its other bug bounty programs.

What remains unknown

  • The exact date the program will resume has not been announced. The first-quarter 2027 update is a date for an update, not a confirmed restart date.
  • The proportion of automated submissions that were AI-generated reports is unknown.
  • The specific impact of the suspension on the review of actual vulnerability reports or on security responses has not been confirmed.

What readers should check

  • Researchers planning to report through the program can check its website for the latest notice on its paused status and the update expected in the first quarter of 2027.
  • Those seeking to report through another channel should check the other bug bounty programs Google has recommended, and confirm the scope and submission requirements for each program separately.
  • If using automated tools to prepare a report, it is important to check before submitting that the report contains a vulnerability that has actually been verified and supporting evidence.