Google OSS VRP Pause: AI Slop Halts Open Source Bug Bounty

Google has stopped taking new product vulnerability reports through its Open Source Software Vulnerability Reward Program (OSS VRP). The company cited a surge of AI-generated submissions that were overwhelming the people responsible for checking them.12 The freeze is narrower than a full shutdown. But it is a significant moment in the fight over what large language models are doing to the economics of security research.

What actually changed

The pause took effect on October 1. Google announced it on X the same day and said it would provide an update on the program's future by the first quarter of 2027.2 The stated goal is to stem the tide of machine-written vulnerability reports that have been arriving in volume.1

Several parts of the program remain intact:2

• Earlier reports: Anything submitted before October 1 will still be processed.
• Supply chain reports: These cover compromised build pipelines and tampered packages, and they are unaffected.
• Cloud-linked code: For some repositories tied to Google Cloud products, researchers can route product bugs through the separate Cloud VRP.

What has been removed is the most common path. A researcher could find a flaw in the code of one of Google's public open-source projects, document it, and collect a reward.2 For most independent bug hunters, that route was the program. So while the pause is technically partial, it shuts the door most people used.

Cheap to generate, expensive to check

The problem is an asymmetry of effort. Someone can now write a script that aims an LLM at a repository and gets back a polished vulnerability report in minutes.2 The report may include a severity rating and a confident proof of concept, and in many cases that proof of concept does not work.2 Most of the AI-assisted submissions turned out to be wrong.2

That imbalance is the whole story. Producing a plausible report has become nearly free. Disproving one still takes skilled human time. A triager has to read the claim, reproduce the conditions, test the exploit, and confirm that nothing is there. When false positives arrive in bulk, the review queue becomes a tax on the maintainers and security staff who are supposed to fix real bugs. One account describes the situation as AI "slop" burying maintainers.2

Bug bounties have always attracted some low-quality or speculative reports. The difference now is scale. A single person with an automated pipeline can file far more reports than a human researcher could plausibly write. Under a pay-per-valid-bug model, even a low hit rate can look like a worthwhile gamble to that person, while the cost lands on the reviewers.

Why it matters beyond Google

Google has more triage capacity than almost any organization in open source. If Google decides the incoming flow is unmanageable enough to freeze a reward channel, smaller projects running on volunteer time are likely under even more strain. The decision is a signal that bounty programs built on open submission may need structural changes, not just more reviewers.

What Google kept open is also revealing. Supply chain reports remain eligible.2 They involve tampered packages and compromised build systems, which are among the most damaging attack classes in modern software. Keeping that category open suggests Google is protecting the area where real findings matter most while it reconsiders the noisier category. Redirecting some product reports to the Cloud VRP indicates the company still wants to hear about real flaws, just through channels it can control more tightly.2

Reading the pause

The two accounts largely agree on the facts. They differ in emphasis. One frames the move simply as a freeze to stop an AI-generated flood.1 The other stresses that headlines overstate how much has closed, and spells out the exemptions and continuing obligations.2 Both points are true. The program is not dead, but its main product-bug pipeline is closed for at least several months.

This looks less like a retreat from open-source security than an admission that the bounty model's assumptions have broken. Those programs assumed that writing a credible report took real effort, which naturally limited volume. Generative AI has removed that limit.

The update promised for early 2027 will show how Google plans to restore it.2 Possibilities include:

• stricter reproduction requirements
• reputation gating for submitters
• penalties for invalid reports
• a narrower scope

Whatever Google chooses will likely become a template for other organizations facing the same flood. Bug bounties can survive AI, but probably not in the open, low-friction form that made them popular.