Google Suspends OSS Vulnerability Reports Program as AI Reports Surge

Google suspends OSS vulnerability submissions after maintainers faced growing volumes of AI-generated security reports, including false findings and hallucinations.

Google has suspended product vulnerability submissions to its Open Source Software Vulnerability Reward Program, or OSS VRP, from October 1, 2026 until at least Q1 2027.

The company says maintainers struggled with the growing number of AI-generated vulnerability reports. While AI tools can quickly produce security findings, every submission still requires human review, including reports based on incorrect assumptions or hallucinated vulnerabilities.

Reports submitted before October 1 remain unaffected by the suspension.

Other Google vulnerability programs remain open

The pause only applies to product vulnerability submissions under the OSS VRP.

Google’s other vulnerability reward programs continue operating, including Cloud VRP and OSS VRP supply-chain submissions.

Security researchers can also continue using Google’s Patch Rewards Program while product vulnerability submissions remain unavailable.

Google plans to rework the OSS VRP

Google plans to revise the OSS VRP before reopening product vulnerability submissions.

The company expects to provide another update in Q1 2027. The revised program could include changes to its submission process and how Google handles rewards.

The suspension highlights a growing issue for open-source maintainers as AI tools make it easier to generate large numbers of vulnerability reports without reducing the human work required to verify them.

In other AI news, Microsoft says attackers are winning the AI race, while Anthropic is investing $100 million in AI training and has also outlined major AI risks in its IPO prospectus.