Google halts product reports to its open-source bug bounty after a flood of invalid AI submissions

The OSS VRP rewards independent researchers who find and disclose flaws across Google's open-source ecosystem. Its product category covers code defects, logic flaws and design bugs in Google's public repositories ^[4]. Tom's Hardware describes that work as painstaking and manual, something that used to take skill, and says large language models and automated bug-hunting scripts have nearly removed its cost ^[5]. Checking a report is still done by hand ^[13]. Google engineers and maintainers were reportedly swamped by thousands of reports describing bugs that turned out to be invalid or unexploitable hallucinations ^[12]. They spent their time validating code by hand instead of fixing real, critical vulnerabilities ^[13]. Mezha, citing TechCrunch, wrote that most of the AI-assisted submissions were invalid ^[6]. It added that reviewers could not keep up with reports built on false data and invented facts ^[14].

The cut is narrow, and I think it is well made. According to Tom's Hardware, product reports filed before October 1 are still in scope ^[7]. Supply chain reports to the same program continue ^[8]. Google also said it may still accept product reports through the Cloud VRP "for some Google Cloud repos impacting Google Cloud products" ^[9]. I would shed load on an overloaded queue the same way: stop the category that is failing and keep reading the work already filed. Google posted the change on X the day it took effect, so researchers with a report half-written on September 30 got no grace period ^[1][7].

Google's experience carries over to a smaller program under two conditions. The intake has to draw the same automated volume, and each report has to need a person to validate it by hand ^[13]. I'd expect the second condition to hold for any project whose reviewers reproduce bugs themselves. The first is harder to judge from outside. Neither report gives Google's invalid-report rate or its review time per report. A team would need both figures to size a triage budget, and the reporting stops at "thousands" and "most" ^[12][6].