Google pauses open source bug bounty submissions after surge of AI-generated reports

The company announced the change in a post published on October 1, 2026, according to TechRadar. "We are temporarily no longer accepting OSS VRP product vulnerability submissions," Google said. "This does not impact OSS VRP supply chain reports, or any outstanding reports." The company pointed researchers toward its other VRP programs and the Patch Rewards Program, and said it would provide an update in the first quarter of 2027. "This pause is due to a significant rise in automated submissions, the vast majority of which are not valid," Google said.

The submissions Google is turning away reflect a broader shift in vulnerability research, where generative AI tools let researchers and companies find flaws at machine speed. Several frontier models, including Mythos and GPT-5.6-Cyber, have allowed organizations to surface far more vulnerabilities in far less time than previously possible.

Microsoft's monthly Patch Tuesday releases offer the clearest illustration. In March 2026 the company addressed 79 flaws in its products. In April, around the time it began using Mythos, that number nearly doubled to 167. It then climbed to 200 in June, 400 in August and 966 in September, meaning that within half a year Microsoft was fixing more than ten times as many flaws per month.

The volume does not translate into reliable fixes. In early August, security researchers at 1Password's Off-by-1 Labs tested how well AI could both discover and repair flaws. They found that 49.3 percent of the patches failed to fix at least one existing exploit path, 20.1 percent fixed the original issue but changed application behavior, and 2.3 percent introduced new security issues. A further 2.2 percent failed to fix the vulnerability while also opening additional exploit paths. Among the patches that could be considered acceptable, more than a third were fragile and did not fully address the underlying problem. 1Password identified missing context as the single biggest challenge, and found that when AI was given proper background information, its results improved substantially.

Many researchers still run vulnerability discovery through AI without supplying that context, using simple prompts, little analysis and minimal human oversight. The resulting reports are frequently incorrect, unsubstantiated or entirely hallucinated, TechRadar reported.

Google is not the first organization to close a bounty program under that pressure. In late January 2026, the developers of curl, the open source command-line tool and software library, ended their HackerOne bug bounty after being flooded with fake problems and vulnerabilities. An advisory published on GitHub stated that the program was sunset at the end of January 2026. "Up until the end of January 2026 there was a curl bug bounty. It is no more," the document read, adding that the project no longer offers rewards for reported bugs or vulnerabilities and does not help researchers obtain such rewards from other sources.

A few months later, in May, the lead maintainer of the Linux security mailing list, Linus Torvalds, described the list as "almost entirely unmanageable" because of AI-generated reports. "The continued flood of AI reports has basically made the security list almost entirely unmanageable, with enormous duplication due to different people finding the same things with the same tools," he said. "People spend all their time just forwarding things to the right people or saying 'that was already fixed a week/month ago' and pointing to the public discussion."