Google stopped accepting new product vulnerability reports through its Open Source Software Vulnerability Reward Program (OSS VRP) on October 1, 2026. The company says a sharp rise in automated submissions—“the vast majority of which are not valid”—prompted the pause. This changes one intake channel, not all security reporting to Google: outstanding OSS VRP reports are unaffected, and Google points researchers to other VRP programs and its Patch Rewards Program.
What Google paused—and why
The change applies to new product vulnerability submissions through the OSS VRP. Google’s October 1 notice says it is “no longer accepting product vulnerabilities submitted to the OSS VRP.” Google attributed the decision to a significant rise in automated submissions, most of which it said were invalid. That is Google’s characterization; the announcement did not give a total report count or an exact invalid-report percentage.
As an Amazon Associate I earn from qualifying purchases.
The pause is not an announcement that Google has stopped all vulnerability reporting, ended its other reward programs, or halted open-source security work. Nor does the statement establish that AI-assisted research is unwelcome or that AI-generated reports are necessarily false. It addresses automated submissions and the validity of the reports Google says it received.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesWhat happens to existing reports, and when will the program change?
Google said reports submitted before October 1, 2026 are not affected by the pause. For the paused intake, the company said it would continue reworking this aspect of OSS VRP and provide an update in Q1 2027. That is a commitment to an update, not a confirmed date for reopening submissions.
#1 Best Overall
Where researchers can report or contribute now
Google’s notice recommends looking for impact that fits its other Vulnerability Reward Programs (VRPs), or pursuing the Patch Rewards Program. These are alternatives to consider, not a guarantee that a report can be transferred, accepted, or rewarded. Choose a route based on what the finding actually concerns:
| Route | Best fit by issue type | What to check |
|---|---|---|
| Another Google VRP | A product vulnerability that falls within the scope of that specific program. Google’s OSS VRP rules specifically direct researchers toward Cloud VRP or AI VRP for vulnerabilities in Google open-source projects closely tied to Cloud or AI products. | Check the live program scope and submission instructions before filing; the route depends on the affected product and vulnerability. |
| Patch Rewards Program | A proposed security improvement or patch contribution, rather than simply a product vulnerability report. Google named this as another option during the pause. | Review the current program terms to determine whether the proposed contribution fits. The announcement does not promise eligibility or payment. |
Report upstream before contacting Google about an open-source package
Google’s OSS VRP rules direct researchers to contact the owner of the vulnerable package first and ensure the issue is addressed upstream before sending Google the vulnerability details. In practice, that means following the package’s security-disclosure process, coordinating the fix with its maintainers, and checking the relevant Google program’s current scope before submitting anywhere else.
For a vulnerability in a Google open-source project closely tied to a Cloud or AI product, the rules point researchers to Cloud VRP or AI VRP to help route the report. Confirm the live rules for the specific finding rather than assuming the paused OSS VRP submission can be redirected automatically.
What Google has—and has not—said about the volume
Google’s October notice describes a significant rise in automated reports and says most were invalid, but it does not publish a report total, a precise invalid share, or a figure for reviewer time spent on submissions. The available statement therefore explains the company’s stated reason for the pause without quantifying how large the workload was.
Rank #3
Google had also discussed a rise in AI-generated reports in a March 2026 OSS VRP rules update, providing context for its later action. That earlier context does not establish that every AI-assisted submission is invalid or independently quantify the October intake.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
