Open Source Vulnerability Reward Program

Google has stopped accepting vulnerability reports for open-source software through its bug bounty program as of October 1. The company will temporarily no longer pay rewards for product flaws found in open-source projects, though reports on its own flagship products continue. The move is drawing attention in the security community, as the open-source incentive program was seen as an important way to support researchers auditing widely used projects.

Google has frozen its open source bug bounty program, citing a significant rise in submissions generated with the help of AI. The company says automated, low-quality vulnerability reports are overwhelming reviewers, making it harder to identify genuine security flaws. The move highlights a growing problem across the security industry as AI tools make it easy to mass-produce plausible-looking bug reports.

Google is restricting its bug bounty program covering open source projects after a surge of low-quality, automated vulnerability reports flooded its review process. The company says AI-generated submissions, many invalid or low-value, have overwhelmed security teams, forcing it to narrow eligibility and tighten criteria for rewards. Security researchers are debating the move, with some warning that legitimate findings may now be overlooked as programs tighten rules across the industry.

Google has temporarily paused its open-source bug bounty program, which paid researchers for reporting vulnerabilities in open-source projects. The company cited an explosive surge in submissions as the reason, and reports suggest the volume of reports has left the program unable to keep up while Google reviews how to handle the influx.

Google has paused its open source bug bounty program after being overwhelmed by a wave of AI-generated vulnerability reports. The automated submissions have flooded reviewers with low-quality, often invalid findings, making the program difficult to manage. The move highlights a growing problem for security teams as generative AI tools make it easy to mass-produce bug reports that look plausible but waste researchers' time.

Google has paused its open source bug bounty program, citing a flood of AI-generated spam reports. The program paid security researchers for finding vulnerabilities in open source projects. Reports say low-quality, automated submissions made it difficult for reviewers to identify genuine findings, prompting the suspension while the company reassesses how the program is run.

Google has temporarily stopped accepting product vulnerability reports under its bug bounty program for open-source software as of October 1st. The pause means security researchers can no longer submit findings for Google open-source projects for the time being. The company has not fully explained the reasons, and observers are watching whether the program will resume and what the move means for open-source security research.

Google has temporarily paused its open-source bug bounty program, which pays researchers for reporting security flaws in projects like Chromium and Bazel, after a wave of low-quality, AI-generated submissions flooded the system. The company says the volume of automated, invalid reports made it hard to review legitimate vulnerabilities, forcing the suspension.

Google has announced it is pausing its Open Source Vulnerability Reward Program through 2026. The program paid security researchers for finding bugs in Google's open-source projects, including Bazel, Angular, and Fuchsia. The pause means researchers cannot submit new reports for rewards during this period, and observers are questioning what the decision signals about Google's commitment to open-source security funding.

Google has paused part of its Open Source Vulnerability Reward Program (OSS VRP), halting vulnerability search activities after a wave of AI-generated reports. The company is said to be dealing with a flood of low-quality or automated findings produced by artificial intelligence tools, prompting a temporary stop while it reassesses how such submissions are handled.