Google halts its open-source bug bounty program, flooded by AI-generated reports
On 5 October 2026, Google froze product vulnerability submissions to its OSS VRP, drowned under a wave of automated reports that are mostly invalid. Researchers must now route work through the Patch Rewards Program or the Cloud VRP, pending a redesign announced for Q1 2027.