Our takeGoogle's OSS VRP pause shows how LLM slop now drowns real vulnerability reports. The signal-to-noise collapse was predictable; bug bounties were already repricing for this exact problem.Cyber Resilience desk
Sources (2)
- helpnet · helpnet
- securityweek · securityweek
What this means for you — Security leader:Google has paused new submissions to its OSS VRP due to a flood of low-quality, AI-generated reports. Review any pending OSS bounty submissions and watch for an updated process or triage changes.
What this means for you — Lean IT orgs:Most lean-IT teams do not participate in Google's open-source bug bounty program. No action is required unless you maintain public open-source projects that previously submitted reports through it.
What this means for you — MSP:Advise clients who maintain or depend on Google-supported open-source projects that the OSS VRP is temporarily closed to new vulnerability reports. Monitor for reopening announcements and adjust any coordinated disclosure workflows.
What this means for you — Researcher:Google's OSS VRP no longer accepts new product vulnerability reports as of 1 October 2026. Shift focus to other bounty programs or direct disclosure channels for open-source issues until the pause lifts.