Google Stops Taking Product Bug Reports as AI Fakes Flood In

Google announced that starting October 1, 2026, its Open Source Software Vulnerability Reward Program (OSS VRP) will no longer accept product bug reports. Bugs submitted before that date are still valid. Reports involving Google Cloud code can still go through the Cloud Vulnerability Reward Program.

OSS VRP is a bounty program that pays independent security researchers to find and responsibly report flaws across Google's open source projects.

According to media reports, Google engineers and open source maintainers have been buried under thousands of low-quality reports. These claimed to reveal serious bugs, but turned out to be AI "hallucinations" — fake, invalid and impossible to exploit. Verifying these false reports ate up resources and cut into time for fixing real high-risk bugs. That is why Google pulled the plug.

Google said it will keep reworking the program and plans to share updates in the first quarter of 2027.