Google has temporarily stopped accepting product-vulnerability submissions to its Open Source Software Vulnerability Reward Program, citing a surge in automated reports that are overwhelmingly invalid. TechCrunch reports that the pause took effect on October 1.

The scope is narrower than a shutdown of Google's open-source rewards effort. In its announcement, Google Bug Hunters explicitly says OSS VRP supply-chain reports and outstanding reports are unaffected. Researchers are encouraged to investigate issues covered by other Google vulnerability reward programs or pursue the Patch Rewards Program.

“This pause is due to a significant rise in automated submissions, the vast majority of which are not valid,” Google said. The company plans to rework this part of the program and has committed to an update in the first quarter of 2027. That is an update deadline, not a confirmed reopening date.

TechCrunch frames the development as part of the growing burden of AI-generated security reports. Google's own announcement uses the broader term “automated submissions” and does not quantify how many reports arrived, their precise invalidity rate, or which tools produced them. Those distinctions matter when assessing what the pause demonstrates about AI-assisted security research.

For developers and researchers, the immediate consequence is a change in submission eligibility, not the end of every Google bounty channel. The decision also highlights a practical bottleneck in automated vulnerability discovery: generating candidate findings is only useful when maintainers can reproduce and validate them. Google's next update will be important for understanding how it intends to reopen or redesign that intake process.