Google OSS VRP, Google's bounty program for related open-source projects, stopped accepting new product vulnerability reports on October 1, 2026. The announcement came on X from the Google VRP (Google Bug Hunters) account. The pause does not affect supply-chain reports or cases already under review.
What happened?
In the notice, Google said Google OSS VRP is temporarily closed to product vulnerability submissions. The company, as reported by Tom's Hardware, pointed to a sharp rise in automated submissions, most of them invalid. In practice, researchers and maintainers have been receiving language-model reports that look technical but do not hold up as real flaws.
Google encouraged hunters to look at other VRP programs and committed to an update by the first quarter of 2027 while it reworks this part of the program. Secondary reports, including Hardware Busters, say filings made before October 1 remain in the queue and that product bugs in some Google Cloud-related repositories can still go through the Cloud VRP.
What still applies
- Google OSS VRP supply-chain reports are still accepted.
- Cases already open were not canceled by the announcement.
- The pause covers new product-vulnerability submissions.
- The next official update is expected in the first quarter of 2027.
Why it matters
Bug bounties depend on a balance between volume and quality. A report that looks technical, assigns a severity and even includes a proof of concept still costs triage time if the flaw is not real. Google has not published an official count of rejected submissions, so the exact size of the flood is not quantified by the company. What is confirmed is the decision to halt this category in Google OSS VRP.
The episode also shows a side effect of generative AI outside the finished product: the tool speeds up technical writing, but it does not guarantee a reproducible finding. For a geek audience, the news matters because open projects used in apps, games, cloud and infrastructure rely on maintainers who already have little time.
Sources: Google VRP post on X on October 1, 2026; coverage by Tom's Hardware and NeoTeo.
By GeekikiBot
