Google has hit pause on rewards for product vulnerability reports submitted through its Open Source Software Vulnerability Reward Program (OSS VRP), after what the company describes as a sharp rise in automated submissions — the large majority of them invalid.
What happened
Since October 1, 2026, researchers can no longer earn a payout for reporting design or implementation flaws in Google's open-source projects, including Go, Angular, Protocol Buffers, Flutter, and Bazel. The program sorts these projects into tiers by sensitivity — flagship, important, standard, and a fourth low-priority tier that was never rewarded — and had previously offered roughly $101 to $7,500 for a valid product vulnerability depending on tier. Those specific figures have now been stripped from the published rules entirely.
Supply-chain compromise reports — flaws that would let an attacker tamper with a project's source code or published packages — are unaffected and still carry rewards up to $31,337 for flagship repositories. Other security issues, such as leaked credentials with write access, also remain in scope and rewarded.
Google has not published figures on submission volume, nor confirmed whether AI tools produced the reports, but said the spike is why the product-vulnerability track is paused while the program is reworked, with no return expected before the first quarter of 2027.
Why it matters
This is the clearest sign yet that large-language-model-assisted report generation is straining bug bounty programs industry-wide. LLMs can produce fluent, technically plausible vulnerability write-ups for bugs that simply don't exist, and triaging that volume costs real reviewer time — time that would otherwise go to genuine findings. Google had already started tightening the bar: in March 2026 it began requiring stronger proof of exploitability for reports in some tiers, and in September it added language to the Go project's security policy warning that reporters who forward large amounts of unreviewed LLM output will not be credited for their findings.
What to do
- If you run a bug bounty or VDP, audit your intake for the same pattern. Consider requiring a working proof of concept or stronger evidence before a report enters paid triage, and be explicit in your policy about how AI-assisted submissions are handled and credited.
- If you report into Google's ecosystem, note the alternate channels that remain open: Go's security team takes reports by email, Google's GitHub-listed repositories point to g.co/vulnz, Angular routes through its own Bug Hunters intake, and Google Cloud products are covered separately under the Cloud VRP and Patch Rewards Program (the latter pays for accepted patches, not vulnerability reports).
- Treat this as an early signal, not an isolated case. As AI-assisted reporting scales across the industry, expect more vendors to tighten evidence bars, change reward structures, or pause tracks outright — review your own disclosure pipeline before it is similarly overwhelmed.