Drowning in AI, Google makes a radical move in cybersecurity

On October 1, 2026, Google paused its rewards program for vulnerabilities in open-source software, known as OSS VRP. The Mountain View giant points to a surge in vulnerability reports automatically generated by artificial intelligence.Google points out that the vast majority of reports are worthless.

📢 PSA for open-source bug hunters

We are temporarily no longer accepting OSS VRP product vulnerability submissions. This does not impact OSS VRP supply chain reports, or any outstanding reports. As an alternative, we encourage you to find impact across our other VRP programs and submit there instead, or pursue the Patch Rewards Program.

Why is this happening? This pause is due to a significant rise in automated submissions, the vast majority of which are not valid. We will continue to reformat and work on this aspect of the OSS VRP and commit to giving an update in Q1 2027.

https://t.co/nQEkHVfbHS

— Google VRP (Google Bug Hunters) (@GoogleVRP) October 1, 2026

“A significant increase in submissions”

The company bluntly explains that “this pause is due to a significant increase in automated submissions, the vast majority of which are invalid”. Google engineers and open-source project maintainers were simply overwhelmed by all these invalid reports, which were riddled with gross errors. They were especially full of hallucinations—fictions generated by AI.

Launched in August 2022, the OSS VRP program rewards the discovery of vulnerabilities in Google open-source projects such as Golang, Angular, Bazel, Protocol Buffers, or Fuchsia, as well as in third-party infrastructure. Rewards generally range from 100 to 31,337 dollars.

Google clarifies that it is“temporarily no longer receiving” vulnerability reports for products covered by the OSS VRP. Reports concerning the software supply chain are not affected, however. Neither are cases already underway. Google says its teams will still handle vulnerabilities submitted before October 1, 2026. The program is not disappearing altogether. Google says it is working to“reformat” this aspect of its system and“commits to providing an update in the first quarter of 2027”. Pending an update, the U.S. giant is inviting researchers to turn to its other bounty programs.

Also read: 17 trillion records – a 16-year-old teenager discovered a Microsoft vulnerability with his own AI

All tech giants are affected

AI has completely disrupted vulnerability hunting at Google over the past two years. Last year, Big Sleep, the in-house AI developed by the DeepMind and Project Zero divisions, uncovered its first vulnerability in Chrome’s codebase. A few months later, the AI helped uncover more than 1,000 vulnerabilities in Chrome. Over 100 vulnerabilities were subsequently patched at the end of September, including more than 10 critical flaws. Google was therefore forced to double the pace of its browser updates. This flood mechanically results in an explosion in bounties.Last year, Google did indeed pay a record $17.1 million to more than 700 researchers, 40% more than in 2024.

Google is not the only tech giant to be overwhelmed by AI-assisted discoveries. Apple is in the same boat. This summer, the Cupertino giant revealed that vulnerability reports were coming in much faster than its teams could process them. Mirroring Google, Apple was forced to speed up the cadence of its security patches. Microsoft tells a similar story. In September, the Redmond giant fixed a record number of 966 vulnerabilities in the Windows codebase in a single Patch Tuesday. For Linus Torvalds, the creator of Linux, the situation has even become unmanageable for his teams. Last month, Intel ultimately removed all financial bounties from its Intigriti platform without explaining its decision for the time being.

👉🏻 Follow tech news in real time: add 01net to your sources on Google, and subscribe to our WhatsApp channel.