Google Suspends Open Source Vulnerability Rewards Program

Google has paused its Open Source Software Vulnerability Rewards Program, which pays for vulnerabilities in open source code. Report intake stopped on October 1, 2026. The company announced the pause in a post on X and on the program's page.

The cause is a notable rise in automated submissions. In the company's wording, the vast majority of such reports are invalid.

The program covered vulnerabilities specifically in Google's open source software. Researchers received a cash reward for the problems they found.

Cybersecurity experts had warned earlier about the risks created by a flood of AI-generated reports. A year ago, TechCrunch wrote that "AI slop" could become a serious problem for vulnerability reward programs.

Now Google's program has run into this as well. According to Tom's Hardware, the company's engineers and maintainers of open source projects were overwhelmed by reports that were invalid or contained fabricated details.

While the program is paused, participants are being asked to turn to other Google reward programs for vulnerabilities they find. The company promises to provide an update on the status of the paused program in the first quarter of 2027.

Image: Google INC Public domain

Translation editors: Соловьев В., Пеков А.