Google has temporarily stopped paying rewards for vulnerability reports on its open-source projects; the reason for this decision is a sharp increase in reports generated with the help of generative AI, many of which lack real value.
According to ITNA quoting TechSpot, Google’s security team says the “vast majority” of these reports contain invalid information or fabricated data about vulnerabilities, and their high volume has strained human experts’ capacity for thorough review.
The program currently paused is Google’s Open Source Software Vulnerability Rewards Program (OSS VRP). This program was launched to encourage security researchers to find and report security issues in Google’s open-source projects. Researchers received financial rewards for discovering valid vulnerabilities, and Google benefited from improved security in projects such as Go, Angular, and Fuchsia.
But the rise of a phenomenon called Vibe Coding has changed the situation. In this method, users rely on AI models to generate or modify code. Those same tools are now being used to prepare security reports, resulting in a dramatic increase in automated, low-quality reports.
Google’s bug-hunting team has announced that the OSS VRP will not accept new product vulnerability reports after October 1. Reports submitted before that date will still be reviewed. Some Google Cloud repositories may still accept new reports, but the main program is being redesigned to adapt to the new conditions. Google plans to announce the future of the program in the first quarter of 2027.
Google has made exceptions for some reports. Software Supply Chain vulnerabilities remain of special importance, because a flaw in this area can affect a very large number of users and projects. Reports about extremely dangerous vulnerabilities may also still be accepted.
This problem is not limited to Google. Large projects such as Microsoft Edge and Linux have also seen an increase in AI-generated reports. Some smaller projects have even decided to ban AI-generated contributions entirely so their limited teams are not overwhelmed by reviewing a large volume of low-quality content.
As a result, AI that can speed up programming and vulnerability discovery has simultaneously created a new problem for the software security process: an increase in false signals and a harder job distinguishing real issues from fabricated reports.