- Published on
Flood of AI “Hallucination” Reports Overwhelms Maintenance Teams, Google Pauses Some Open-Source Bug Bounty Programs
- Authors
- Name
- DeepHorus
Google suspends OSS VRP product vulnerability submissions as AI hallucination reports add to maintenance burden.
Google announced on October 4 that, starting October 1, 2026, the Open Source Software Vulnerability Reward Program (OSS VRP) will no longer accept product vulnerability submissions. This suspension will not affect product vulnerabilities submitted before October 1; reports for them will continue to be handled under the existing process. The rule change stems from the severe burden that large numbers of AI-generated, actually invalid vulnerability reports have placed on open-source maintenance teams.
OSS VRP is Google's professional security bounty program for the open-source ecosystem. It is intended to encourage independent security researchers to find and responsibly disclose security flaws. Participants may inspect code throughout Google's entire open-source ecosystem and submit qualifying product vulnerabilities. Google said it will continue reorganizing and optimizing the mechanisms related to the program during the suspension.
According to Tom's Hardware, Google engineers and open-source code maintainers have received thousands of low-quality vulnerability reports. People familiar with the matter said the reports claimed to have identified serious vulnerabilities, but after thorough investigation, all were determined to be AI "hallucinations." The flaws alleged in the reports do not exist and cannot be exploited in practice.
Because these reports are extremely numerous and of low quality, maintenance teams have had to devote substantial amounts of time to validating the false code in them and assessing, one by one, their impact and exploitability. Tom's Hardware said this work has severely eaten into the time maintainers have available to fix genuine high-risk vulnerabilities. The sheer volume of invalid AI-generated reports was therefore the direct reason Google stopped accepting product vulnerability submissions.
Google has simultaneously retained a supplementary channel specifically for Google Cloud products. For certain Google Cloud code repositories that could affect Google Cloud products, if a product vulnerability is involved, Google may still receive relevant reports through the Cloud Vulnerability Reward Program (Cloud VRP). This adjustment does not mean that all cloud security reports have stopped being processed; the suspension is focused primarily on product vulnerability submissions under OSS VRP.
After October 1, independent researchers will no longer be able to submit new product vulnerabilities through OSS VRP, while vulnerabilities submitted before that date will not be affected by this rule change. Google said it will continue to reorganize and optimize the mechanisms associated with OSS VRP to address the maintenance pressure caused by AI-generated reports. Google plans to announce relevant progress in the first quarter of 2027, but the specific process after optimization has not yet been announced.
This suspension reflects the practical challenges facing open-source vulnerability reward programs as AI-generated reports surge in volume and their quality becomes difficult to control. For Google and maintainers in its open-source ecosystem, reducing the time spent validating invalid reports is an important step in restoring the efficiency of fixing high-risk vulnerabilities. As the mechanism adjustments proceed, how OSS VRP will subsequently resume product vulnerability submissions while continuing to cover Google Cloud-related code repositories will become a matter of public concern.
