Google pauses OSS VRP submissions until 2027 due to AI-generated erroneous vulnerability reports

Google has temporarily suspended new product vulnerability reports under its Open Source Software Vulnerability Reward Program (OSS VRP).

The company announced that it has not been accepting new reports in this category as of October 1, 2026. The program is planned to be reorganized by the first quarter of 2027, with further updates expected at the end of this process.

The decision follows a surge in erroneous security reports prepared using generative AI tools. It is noted that some of these reports contain vulnerabilities that do not actually exist, yet security teams are forced to review each submission individually.

WHICH SUBMISSIONS WILL BE AFFECTED?

The suspension applies only to product vulnerability reports under the OSS VRP. Reports submitted before October 1 will continue to be evaluated within the existing process.

Submissions under the Google Cloud Vulnerability Reward Program and OSS VRP supply chain reports will not be affected by the change. Security issues in certain open-source repositories concerning Google Cloud products can still be reported via the Cloud VRP.

The OSS VRP encourages independent security researchers to identify and report vulnerabilities in Google's open-source projects. Rewards are provided for valid reports that meet the program's criteria.

However, the increased use of AI tools in code scanning and report generation has led to a high volume of submissions in a short period. While some AI-assisted reports contain valid findings and suggested solutions, the rise in erroneous submissions has hindered the program's operations.

During this period, Google will direct researchers to other security reward programs. The company suggests submitting reports through the Patch Rewards Program and, where applicable, the Cloud VRP. When the program reopens, changes to certain rules, including the reward system, may be on the agenda.