Google has suspended its Open Source Software Vulnerability Reporting Program due to a surge in low-quality, AI-generated reports. the company intends to relaunch a streamlined version of the bounty system in early 2027.
The $31,000 payout pause at Google
Google's Open Source Software Vulnerability Reporting Program (OSS VRP), which once offered payouts as high as $31,000 for critical security findings, has been put on hold. According to the report, the suspension is a direct response to a massive influx of submissions generated by large language models (LLMs) that lack actual substance.
These AI-generated reports often contain "hallucinated" or entirely fake vulnerabilities, which force human security engineers to waste time vetting meaningless claims. By pausing the paid bounty scheme, Google aims to stop the financial and operational drain caused by non-experts using AI to spam the system for rewards.
Why a Q1 2027 relaunch is necessary to filter LLM noise
The decision to wait until the first quarter of 2027 to relaunch the OSS VRP sugegsts that Google believes the current tools for filtering AI noise are insufficient. as reported, the company plans to use this interim period to redesign the submission process to ensure that only high-quality, actionable insights reach their engineers.
While the OSS VRP is dormant, Google is directing researchers toward its other active channels, specifically the Vulnerability Recognition Program (VRP) and Patch Rewards. These remaining programs maintain stricter quality controls to prevent the same level of AI-driven contamination that crippled the open-source initiative.
How Google and Anthropic are turning to scanned books
The struggle with bug bounties is part of a larger systemic issue known as "garbage in, garbage out," where AI models begin learning from the very noise they create. To prevent this self-reinforcing cycle of degradation, companies like Google and Anthropic are aggressively seeking "clean" data sources.
One specific strategy involves investing in the digitization of scanned physical books. Because these texts were written by humans before the era of generative AI, they provide a gold standard of linguistic and logical grounding that is free from the hallucinations common in modern web-scraped datasets.
The 1,000 Linux kernel vulnerabilities that prove AI's utility
Despite the noise, AI is not purely a liability in the cybersecurity space. A recent study highlighted the analytical power of LLMs by demonstrating their ability to discover over 1,000 vulnerabilities within the Linux kernel, proving that the technology can surface genuine threats when used correctly.
This creates a paradox for the industry: the same tools that enable a few sophisticated researchers to find critical flaws also empower thousands of low-skill users to flood companies with fake reports.. The challenge for the cybersecurity ecosystem is to reward the former without being overwhelmed by the latter .
Who will vet the reports during the OSS VRP hiatus?
While Google has pointed researchers toward the VRP and Patch Rewards, it remains unclear how the company will handle the transition of existing open-source reports during the pause. the source does not specify whether pending OSS VRP claims will be honored or if they will be migrated to the other reward channels.
Furthermore, there is a lack of detail regarding the specific "streamlined" mechanisms Google intends to implement by 2027. It is unknown if the company will require cryptographic proof of human authorship or implement a pre-screening AI to filter out the very hallucinations that caused the program's suspension.
Comments 0