Google has temporarily stopped accepting new product vulnerability reports through its Open Source Software Vulnerabilit...

Google has temporarily stopped accepting new product vulnerability reports through its Open Source Software Vulnerability Reward Program, citing a sharp rise in automated submissions that human reviewers say are mostly wrong. What HappenedThe company announced the pause on October 1, 2026, in posts on X and on the program page. Google said the freeze was driven by a significant rise in automated submissions, the vast majority of which are not valid. Engineers described polished write-ups that still failed basic checks: wrong triggering conditions, exploit paths that do not exist, and claims that a weak function was reachable when it was not.The pause is narrower than a full shutdown. Reports already in the queue continue to be reviewed. Supply-chain bug reports remain open, as does the Patch Rewards Program. Some product issues in Google Cloud repositories may still be filed through the Cloud VRP. Google said it will rework this part of the OSS VRP and commit to an update in the first ...