Google Halts OSS VRP Due to AI Spam
The End of Product Vulnerability Submissions
Google recently announced that, effective October 1, 2026, its Open Source Software Vulnerability Reward Program (OSS VRP) will permanently cease accepting submissions for product vulnerabilities. Importantly, this sweeping policy adjustment will not affect any product vulnerabilities formally submitted prior to that date.
However, Google maintains a specific exception for certain Google Cloud repositories that might directly impact its enterprise cloud ecosystem. For these critical infrastructure components, the technology giant may still process relevant product vulnerability reports through its dedicated Cloud Vulnerability Reward Program (Cloud VRP).
The Legacy of the Security Bounty Program
Historically, the Open Source Software Vulnerability Reward Program functioned as a specialized security bounty initiative established by Google. Its primary objective was to incentivize independent security researchers to actively discover and responsibly disclose hidden security flaws across the vast Google open-source ecosystem.
AI Hallucinations Overwhelm Maintainers
According to Tom’s Hardware, industry insiders recently revealed that Google engineers and dedicated open-source maintainers have become entirely overwhelmed by thousands of exceedingly low-quality reports. These spurious submissions boldly claimed the discovery of critical vulnerabilities. However, upon rigorous investigation, security teams discovered that these reports were merely artificial intelligence hallucinations. Consequently, these supposed threats proved entirely invalid and fundamentally impossible to exploit in any real-world scenario.
The dedicated maintenance teams tragically exhausted tremendous energy attempting to verify these fabricated code structures. This futile endeavor severely diminished the vital time required to patch genuine, high-risk vulnerabilities. Ultimately, this overwhelming influx of artificial intelligence spam served as the direct catalyst forcing Google to terminate the program.
Future Optimization Plans
Moving forward, Google officially stated its commitment to continuously restructure and optimize the underlying mechanisms of the OSS VRP framework. The corporation plans to formally unveil its latest operational progress during the first quarter of 2027.
