Google has temporarily stopped accepting new product vulnerability submissions to its Open Source Software Vulnerability Rewards Program after being flooded with low-quality, AI-generated reports. The pause took effect on October 1. 'This pause is due to a significant rise in automated submissions, the vast majority of which are not valid,' the company said. The OSS VRP, launched in August 2022, rewards researchers for finding flaws in Google-maintained open-source projects such as Golang, Angular, Bazel, Protocol Buffers and Fuchsia, with rewards from $100 to $31,337. Supply-chain reports and submissions made before October 1 are unaffected. Researchers can still submit patches through the Patch Rewards Program, worth up to $15,000, or report cloud vulnerabilities via the Cloud VRP. Google said it will rework the programme and give an update in the first quarter of 2027. Google is not alone: the curl project ended its bug bounty in January 2026 after a similar flood of AI-generated reports.