Google freezes product flaw submissions to its OSS Vulnerability Reward Program over an influx of invalid AI-driven reports, plans an update by Q1 2027
Context & Ripple Effects
Google had already broadened bug-bounty work for generative-AI-specific risks in 2023 through guidance for generative AI vulnerability reports, then created a separate AI bug bounty program in 2025. The OSS program pause shows that AI is affecting not only the flaws bounty programs seek, but also the volume and quality of submissions they must verify.
Google says the temporary halt applies to OSS product-vulnerability reports, while supply-chain reports and outstanding submissions remain in scope. Its planned Q1 2027 update makes submission handling and validation rules the immediate operational issue.
First-order effects
- OSS security researchers cannot submit new product-vulnerability reports to Google's OSS Vulnerability Reward Program during the pause; supply-chain and pending reports are not affected.
- Google must redesign or update the program's product-report intake by Q1 2027 while handling the invalid AI-driven submissions that prompted the freeze.
Second-order effects
- The pause raises the cost of participation for legitimate OSS bug hunters, because a valid finding no longer has an active product-report path within this reward program.
- Google's security team faces a verification bottleneck: accepting AI-assisted reports at scale requires stronger evidence and triage rules than a conventional bounty intake.
Third-order effects
- If AI-generated low-quality reporting persists, vulnerability-reward programs will increasingly compete on validation systems and reporter-quality controls rather than reward size alone.
- The expansion of AI security programs alongside tighter submission gates points to a broader split between encouraging AI-focused research and governing AI-mediated security workflows.
The trend: AI is enlarging the security-reporting pipeline faster than human-led bounty triage can reliably validate it, pushing programs toward stricter intake governance.