Google says that, as of 1 October 2026, it is no longer accepting product vulnerability submissions to its Open Source Software Vulnerability Reward Program, the OSS VRP. Its rules page commits to an update in the first quarter of 2027, and its post on X says supply chain reports are not affected. TechCrunch, reporting on 4 October, quotes Google as saying the pause is due to “a significant rise in automated submissions, the vast majority of which are not valid.”
The rules page for the OSS VRP opens its product vulnerabilities section with a notice in Google’s own words: “As of October 1, 2026, we are no longer accepting product vulnerabilities submitted to the OSS VRP.”
The notice adds that for some Google Cloud repos impacting Google Cloud products, Google “may still accept reports covering product vulnerabilities through the Cloud VRP.” It says Google will “continue to reformat and work on this aspect of the OSS VRP and commit to giving an update in Q1 2027.”
In the meantime, the page says it encourages researchers to “find impact across our other VRP programs and submit there instead, or pursue the Patch Rewards Program.” It also says the change “does not affect product vulnerabilities submitted before October 1, 2026.”
From Google’s OSS VRP rules page: the typical rewards it lists for supply chain compromises, by project tier. The page lists no amount for low-priority (OT3) projects, and none for product vulnerabilities in any of the four tiers. Final amounts are at the discretion of the reward panel.
What Google’s Post on X Says
The Google VRP account posted on 1 October. The text this publication could read says: “We are temporarily no longer accepting OSS VRP product vulnerability submissions. This does not impact OSS VRP supply chain reports, or any outstanding reports.”
The visible text continues by encouraging bug hunters to find impact across Google’s other VRP programs, and then ends. The word “temporarily” appears in the post; this publication did not find it on the rules page. It could not open the post in full, so nothing beyond the text above is reported here.
Business Pill · THE COST OF CHECKING
A one-minute explainer of the idea behind this story: verification cost. It teaches the concept, not this story’s figures.
The key insight:Google’s rules page and X post limit the stop to product vulnerability submissions and say supply chain reports are not affected. The reason Google is quoted as giving comes from TechCrunch, not from the rules page or the visible part of the X post, and no text read gives a count of submissions.
What Still Pays, by the Rules Page
The rules page has a reward table by project tier. For supply chain compromises it lists $3,133.7 to $31,337 for OT0 (flagship) projects, $1,337 to $13,337 for OT1 (important) projects and $500 to $3,133.7 for OT2 (standard) projects. It lists no amount for OT3 (low-priority) projects.
For “other security issues” the table lists $1,000 for OT0 and $500 for OT1, and no amount for OT2 or OT3. The row for product vulnerabilities lists no amount in any of the four tiers.
The page calls these “typical rewards” and says the final amount is always chosen at the discretion of the reward panel. It still describes product vulnerabilities as a category, with examples and acceptance criteria, and says that for OT2 and OT3 projects all types of product vulnerabilities “are not eligible for monetary reward.”
This publication did not see the page before 1 October, so it cannot say what the table or those paragraphs listed earlier.
The Reason, as TechCrunch and Tom’s Hardware Report It
Neither the rules page nor the visible part of the X post, as this publication read them, states a reason. TechCrunch (Anthony Ha, 4 October) reports that Google announced the pause in posts on X and on the program website, and quotes the company: “This pause is due to a significant rise in automated submissions, the vast majority of which are not valid.”
The quoted sentence says “automated submissions.” The words “AI submissions” are TechCrunch’s own, in its headline and its opening line.
TechCrunch adds, citing Tom’s Hardware, that Google engineers and open source maintainers were overwhelmed by reports that were invalid or contained hallucinations. Tom’s Hardware says the engineers and maintainers were “reportedly” overwhelmed by thousands of poorly written reports. It does not name a source for that detail in the text this publication read.
Tom’s Hardware also offers its own explanation: that large language models and automated AI bug-hunting scripts have “nearly eliminated the cost and effort” the task once required. That is the outlet’s statement, not Google’s.
Where the Wording Differs
TechCrunch’s headline says Google froze its open source bug bounty program, and its opening line says Google paused the program “until next year.”
Google’s own texts, as read here, apply the stop to product vulnerability submissions, say supply chain reports are not affected, and promise “an update in Q1 2027.” They give no date for product submissions to return: the rules page promises only an update, and the X post calls the stop temporary. “Until next year” is TechCrunch’s wording, and “until 2027” is in Tom’s Hardware’s headline.
The sources describe the change at two different scopes. Google’s rules page and X post limit it to product vulnerability submissions to the OSS VRP, and say supply chain reports and outstanding reports are not affected. TechCrunch’s headline and opening line describe the program as frozen or paused until next year.
The reason comes from a different place than the notice. The notice is on Google’s rules page. The sentence about a rise in automated submissions is quoted by TechCrunch, which does not say where it appeared, and neither the rules page nor the visible part of the X post contains it. The labels “AI submissions” and “AI-generated” are TechCrunch’s and Tom’s Hardware’s own.
The rules page’s reward table lists amounts for supply chain compromises and, in the top two tiers, for other security issues. It lists none for product vulnerabilities in any tier. This publication did not see the page before 1 October, so it cannot say whether that row changed.
Google — OSS VRP rules page
“As of October 1, 2026, we are no longer accepting product vulnerabilities submitted to the OSS VRP.”
Three Implications
WHAT THE RULES PAGE KEEPS The rules page still lists typical rewards by tier for supply chain compromises, up to $31,337 for OT0 projects, and says final amounts are at the discretion of the reward panel.
WHAT THE STOP DOES NOT COVER The rules page says the change does not affect product vulnerabilities submitted before October 1, 2026, and that for some Google Cloud repos Google may still accept product vulnerability reports through the Cloud VRP. The X post says outstanding reports are not affected.
WHAT REMAINS UNKNOWN No text read gives a count of submissions or the share judged invalid, and no Google text says in what form product submissions return. The rules page promises an update in Q1 2027. This publication did not contact Google, and none of the claims has been independently checked.
What Is Not Established
None of the four texts this publication read gives a count of submissions received, a count judged invalid, or a share generated by AI. “Significant rise” and “the vast majority” are Google’s quoted words; “thousands” is Tom’s Hardware’s, reported without a named source.
This publication did not find the quoted reason sentence on the rules page or in the visible part of the X post. TechCrunch does not say where the sentence appeared, and this publication could not check the X post in full.
No Google text read says what the Q1 2027 update will contain, or in what form product submissions return. The timeframes “until next year” and “until 2027” are the outlets’ wording. This publication did not contact Google, and it has no response from the company beyond the texts above.
Business Engineer Framework
The Map of AI — How the Layers of the Stack Depend on One Another
The Map of AI places more than 200 companies across nine layers of the stack, from silicon to application, and shows how the layers depend on one another.
Google says it stopped accepting product vulnerability submissions to the OSS VRP on 1 October 2026, with an update promised for Q1 2027. Its post says supply chain reports are not affected, and its rules page still lists rewards by tier for them. TechCrunch quotes Google attributing the pause to a rise in automated submissions, most of them not valid. No count is given in any text this publication read, and it verified none of it independently.
91,000+ executives read Business Engineer for the AI strategy frameworks cited by ChatGPT, Claude, and Perplexity.
A note on sourcing. We drew on Google’s OSS VRP rules page, the visible portion of its X post of 1 October 2026, TechCrunch’s report of 4 October 2026, and Tom’s Hardware’s report. We read those texts only: we could not access the full X post, did not contact Google, and never saw earlier versions of the rules page, so we have not checked any of the claims independently. Nothing here is a forecast or advice of any kind.
Gennaro Cuofano is a CRO and tech executive who has worked in AI since late 2015, starting with bringing NLP, natural-language generation, voice and chatbot products to the marketing industry. His background is in law and finance: he holds a Master's degree in Law and an International MBA with an emphasis on corporate finance (LUISS Business School and the University of San Diego, 2012), and worked as a financial analyst at a real-estate investment firm in San Diego and as an assistant controller. His work focuses on business model strategy, business engineering and, more broadly, structural analysis: how companies make money, read from their own filings. He created FourWeekMBA and leads research there and at The Business Engineer, his newsletter on AI and business strategy, with over 95,000 subscribers and more than 1,000 published analyses. His writing has also appeared on Entrepreneur (for example, How to Digitize a Family Business in Europe) and HackerNoon. Find him on LinkedIn and Substack. See how we source.
