Google Pauses OSS Product Bug Bounty Rewards After Surge in Invalid Automated Reports

Google has temporarily paused accepting product vulnerability reports for its open-source projects via the OSS VRP effective October 1, citing a significant rise in automated low-quality submissions; supply-chain compromise reports and other security issue categories remain eligible for rewards. The change removed listed product-vulnerability payouts for flagship and important projects, directs researchers to alternative channels (Cloud VRP, Patch Rewards, other programs), and signals a planned program update in Q1 2027 while prior measures to curb low-quality and possibly AI-generated reports are discussed.