Google has paused product-vulnerability submissions to its Open Source Software Vulnerability Reward Program (OSS VRP), effective October 1, 2026. The company cited a sharp rise in automated reports, “the vast majority of which are not valid,” and said it would provide an update in the first quarter of 2027. That is a pause in one program’s intake—not a shutdown of every Google vulnerability-reporting channel, and not proof that AI cannot find real bugs.
What Google paused—and what it did not
The pause applies to product vulnerability reports submitted through Google’s OSS VRP. Google’s statement, reported by TechCrunch on October 4, 2026, says the pause began October 1 and is due to “a significant rise in automated submissions, the vast majority of which are not valid.” Google said it would update participants in Q1 2027.
As an Amazon Associate I earn from qualifying purchases.
That scope matters. Contemporaneous reporting says supply-chain reports were still being accepted, and some Google Cloud issues could remain eligible through the separate Cloud VRP. Google’s Chrome Vulnerability Reward Program (Chrome VRP) is also separate; Google’s security blog describes its intake as continuing with a focus on findings that add to internal work and can be processed by its automated pipelines. Eligibility depends on each program’s current rules, so a paused OSS VRP product report should not be treated as a blanket ban on reporting security issues to Google.
How AI can find bugs while producing reports that are rejected
A scanner or AI agent can identify a suspicious code path or generate a plausible vulnerability explanation. That is a candidate, not yet a confirmed security flaw. A useful report must establish that the issue can actually be triggered, that the affected product and configuration are in scope, and that the result has meaningful security impact under the product’s threat model. Google’s April 2026 OSS VRP guidance warned about hallucinated exploit explanations as well as defects that existed in code but were unreachable or had negligible security impact.
#1 Best Overall
- Attention-grabbing design meets the latest evolution of the Google Pixel Camera on the new Google Pixel 11 Pro; Gemini Intelligence helps manage details so you can live in the moment[1]; and the phone is available in two sizes
- Unlocked Android phone gives you the flexibility to change carriers and choose your own data plan: Works with Google Fi, Verizon, T-Mobile, AT&T, and other major carriers[2]
- Stay informed without looking at your screen: When your phone is face down, Pixel HiLight gently alerts you with subtle glowing lights when your favorite contacts are calling or you’re talking with Gemini; exclusive to Google Pixel 11 Pro phones
- Magic Capture catches the moment as you live it: With just one tap, Pixel 11 Pro captures video and photos, and automatically edits, crops, and unblurs a curated collection, ready to share – and you get the memory of how it felt to be in the moment
- Two new cameras for more brilliant photos: A larger telephoto sensor captures 30% more light for clear, beautiful photos and videos, even in the dark[3]; Pixel’s longest zoom ever helps you capture details from impressive distances[4]
Google’s own examples concern controlled internal work, not a head-to-head test against public bounty submissions. Its account describes LLM-assisted fuzzing in 2023, Naptime with Project Zero in 2024, Big Sleep with DeepMind and Project Zero in 2025, and a Gemini-based agent harness searching the broader Chrome codebase in early 2026. Google says the harness found a sandbox escape that had remained in its code for more than 13 years. These are company-reported examples, not an independent comparative evaluation of AI’s bug-finding accuracy.
Google spokesperson Kimberly Samra described the division of labor for Big Sleep to TechCrunch this way: “To ensure high quality and actionable reports, we have a human expert in the loop before reporting, but each vulnerability was found and reproduced by the AI agent without human intervention.” In other words, automated discovery and human review can coexist: the agent can find and reproduce a flaw, while a person checks the report before it is submitted.
Rank #2
- Google Pixel 10a is a durable, everyday phone with more[1]; snap brilliant photography on a simple, powerful camera, get 30+ hours out of a full charge[2], and do more with helpful AI like Gemini[3]
- Unlocked Android phone gives you the flexibility to change carriers and choose your own data plan; it works with Google Fi, Verizon, T-Mobile, AT&T, and other major carriers
- Pixel 10a is sleek and durable, with a super smooth finish, scratch-resistant Corning Gorilla Glass 7i display, and IP68 water and dust protection[4]
- The Actua display with 3,000-nit peak brightness shows up clear as day, even in direct sunlight[5]
- Plan, create, and get more done with help from Gemini, your built-in AI assistant[3]; have it screen spam calls while you focus[6]; chat with Gemini to brainstorm your meal plan[7], or bring your ideas to life with Nano Banana[8]
Why internal discovery and public submissions are different pipelines
Google’s Chrome workflow illustrates the checks between a finding and a fix. In its account, reports are filtered for spam and duplicates; reviewers check that a report describes a Chrome security vulnerability; they reproduce it on affected browser and operating-system versions; then they add details such as where the issue was introduced and its severity before assigning it to a component owner. Google says historical triage took five to 30 minutes or more per report and estimates the newer process saves hundreds of developer hours per month. Those time figures are Google’s estimates, not independent measurements.
Free tools Windows power users keep installed
One-click scans. No signup required.
Google’s separate PageBreak post, published in September 2026, describes an internal Product Security agent for testing Google first-party web applications. The pilot began in November 2025 and became a full project in January 2026. Its key safeguard is deterministic validation: specialized validators execute a real payload against a running environment to test a candidate. Google says PageBreak found more than 500 cross-site scripting (XSS) vulnerabilities and characterizes its false-positive rate as “near-zero”; both are Google’s claims, not externally verified performance metrics.
| Question | Google’s internal discovery work | External vulnerability report |
|---|---|---|
| Access and context | Google describes agents searching its own code or testing its first-party applications. | A submitter’s available code and product context depend on the program and report; the cited guidance warns that reports can misread reachability or impact. |
| Validation | Google describes reproduction in Chrome and, for PageBreak, payload execution against a running environment. | The report must provide enough evidence for the program to reproduce the issue and assess its security impact. |
| Noise handling | Google describes filtering, reproduction, metadata collection, and assignment to a component owner in Chrome triage. | Google says the paused OSS VRP intake was receiving a significant increase in automated submissions, most of which it considered invalid. |
| Outcome being counted | Google’s examples include reproduced findings and reported vulnerabilities. | A submission is not the same thing as a confirmed flaw, a published CVE, or an observed exploit. |
Google also says fuzzing remains useful for bugs that depend on long sequences of interactions or combined operations. Different methods expose different candidate flaws; none eliminates the need to verify the result and route a fix.
More CVEs do not automatically mean more attacks
Google Threat Intelligence Group (GTIG) reported a steep rise in disclosed vulnerability counts in its October 1, 2026 analysis, covering January 2025 through August 2026. These are broad disclosure figures, not counts of OSS VRP reports or AI-written submissions.
Rank #4
- Google Pixel 10 Pro is the ultimate Pixel experience, featuring advanced AI with Gemini, unbelievable camera quality, impeccable design in two sizes, and the next-gen Google Tensor G5 chip[1]
- Unlocked Android phone gives you the flexibility to change carriers and choose your own data plan[2]; it works - Google Fi, Verizon, T-Mobile, AT&T, and other major carriers
- Get a head start on syncing your data before it even arrives: After you purchase your new Pixel, look for an email that explains how to transfer your photos, videos, passwords, and more in just a few quick steps[11]
- Pixel’s pro camera system makes everything look amazing, even in low light; capture more of the scene with advanced Google AI models, and bring out incredible details with 100x Pro Res Zoom, stunning 50 MP images, and super steady videos in 8K[10]
- Pixel 10 Pro is built with durable aluminum and Corning Gorilla Glass Victus 2 for scratch and drop resistance; the 6.3-inch Super Actua display with 3,300-nit peak brightness is easy on the eyes, even in direct sunlight[3,13,18]
| GTIG measure | Reported figure | How to read it |
|---|---|---|
| Monthly CVE disclosures | 5,045 in January 2026; 10,477 in July; 10,740 in August | Disclosure volume rose sharply, but raw totals can be affected by automated CNA assignment and vendor disclosure cycles. |
| “Linux Kernel” description example | About 5,000 CVEs from January through August 2026; GTIG observed zero exploited in-the-wild zero-days among this example set | GTIG used the example to illustrate how automated CNA assignment can inflate counts. It does not establish that every item lacked security relevance. |
| Vulnerabilities disclosed and observed exploited | 141 in January–August 2026, compared with 127 during all of 2025 | This is GTIG’s observed dataset, not a count of every exploit or every vulnerability that might be exploited. |
| Share of 2026 disclosures observed in active exploitation | 0.23%, or roughly 1 in 431 | This is GTIG’s measured share for its 2026 dataset and observation period, not a universal probability for future vulnerabilities. |
| Average observed exploitation | 10.5 vulnerabilities per month in 2025 versus 18 per month in January–August 2026; zero-day exploitation averaged 8 per month in 2025 versus 11 per month in January–August 2026 | GTIG says the larger increase is consistent with rapid weaponization of known, or “n-day,” vulnerabilities; the figures do not prove AI caused the change. |
| High-risk disclosures | 131 in January and 350 in August 2026, a 167% increase; they remained 3% of August disclosures | GTIG used its own risk ratings, not CVSS. |
The distinction is between volume at different stages: candidate reports, confirmed flaws, published CVEs, and vulnerabilities observed in active exploitation are not interchangeable counts. GTIG’s figures show why a larger disclosure total cannot by itself establish that attackers have more usable bugs—or that AI caused Google’s intake problem.
The bottleneck is verification and remediation, not just discovery
Greg Castle, identified as Kubernetes/Google and writing for CNCF, describes the dual effect of AI: “It is now trivial for non-experts to find real vulnerabilities in software with minimal effort. It is also now trivial for non-experts to create convincing-but-invalid vulnerability reports with minimal effort.” Castle says assessing a report can take hours to days; that is a practitioner’s perspective, not a measured estimate for Google’s OSS VRP.
Best Value
- Google Pixel 7 is powered by Google Tensor G2; it’s faster, more efficient, and more secure, with the best photo and video quality yet on Pixel[1].Other camera description:Front,Rear.Bluetooth Version 5.2 with dual antennas for enhanced quality and connection.
- Unlocked Android 5G phone gives you the flexibility to change carriers and choose your own data plan[2]; works with Google Fi, Verizon, T-Mobile, AT&T, and other major carriers
- Pixel’s Adaptive Battery can last over 24 hours; when Extreme Battery Saver is turned on, it can last up to 72 hours[3]
- The 6.3-inch Pixel 7 display is super sharp, with rich, vivid colors; it’s fast and responsive for smoother gaming, scrolling, and moving between apps[4]
- Google Pixel 7 has wide and ultrawide lenses with up to 8x Super Res Zoom[5]; and Cinematic Blur brings more drama to your videos
The broader security pipeline runs from finding a candidate to validating it, assessing impact, developing and releasing a fix, and getting downstream users to upgrade. If candidate generation grows faster than the capacity to verify and remediate findings, more reports can consume maintainer time without producing a proportional increase in security. That helps explain why automated discovery can be valuable inside a team with access to code, test environments, and owners, yet still create extra work when unverified candidates arrive through a public intake channel.
The public evidence establishes Google’s reason for pausing OSS VRP product submissions, but does not quantify the program’s invalid-report share or prove that AI alone caused the pause. It supports a narrower conclusion: AI can help find real vulnerabilities, while report quality, reproduction, impact, and review capacity determine whether a discovery becomes actionable.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
