Google suspends OSS VRP bug bounty program over AI-generated reports
Google has paused its paid Open Source Software Vulnerability Reporting Program after a flood of LLM-generated submissions describing fictitious or unexploitable flaws. Payouts previously reached $31,337; the company says it will relaunch the program in Q1 2027.
- Google paused its paid OSS VRP bug bounty program
- Cause is a flood of low-quality LLM-generated reports
- Top payout was $31,337 for critical vulnerabilities
- Program relaunch is planned for Q1 2027
Read next
Security