Google froze its open source bug bounty program due to a ‘significant rise’ in AI submissions
Google has paused new product vulnerability submissions to its open source bug bounty, the OSS VRP, after a “significant rise in automated submissions, the vast majority of which are not valid”. Supply chain reports and queued reports are unaffected, and Google promises an update in Q1 2027. We explain what is paused, why AI slop broke the model, how curl, HackerOne’s Internet Bug Bounty, Node.js and Intel got there first, and what it means for researchers and UK businesses.
