Google pauses open source bug bounty amid AI spam submissions

Google has paused its Open Source Software Vulnerability Reward Program (OSS VRP) after receiving a large number of AI-generated spam submissions. The company urged researchers to participate in other reward programs, with an official update scheduled for Q1 2027. Notably, researchers can still report product vulnerability tied to Google Cloud repositories that impact Cloud projects.