On October 1, Google officially paused its long-running Open Source Software Vulnerability Reward Program (OSS VRP), citing a single reason: a "significant rise" in automated submissions, the vast majority of which are not valid. The notice went up simultaneously on bughunters.google.com and Google's X account — Google is promising an update in Q1 2027, and in the meantime, researchers are being nudged toward Google's other bug bounty programs.\n\n## Not an abstract AI-misuse story, just hours being eaten alive\n\nOSS VRP was set up to incentivize independent security researchers to find and responsibly disclose vulnerabilities across Google's open source ecosystem; product vulnerability submissions and reports against Google Cloud code repos both flow through it. Unlike most bug bounties, OSS VRP covers code that Google either owns or heavily depends on — when a CVE lands here, blast radius propagates through the whole open source stack. The fact that Google chose to "pause" rather than "tweak the rules" is itself an unusual posture.\n\nWhat triggered the pause isn't some abstract "AI misuse" narrative — it's a concrete people-and-hours problem. According to sources cited by Tom's Hardware, Google engineers and open source maintainers have been completely overwhelmed by thousands of low-quality reports that claim to surface severe vulnerabilities but, after triage, turn out to be AI-generated hallucinations that are neither reproducible nor exploitable. Maintainers have had to spend enormous effort validating reports that look rigorous but are entirely fabricated by models; time on real high-severity fixes gets squeezed. The same problem exists across the industry, and Google isn't the first — just the firmest to flip the switch.\n\n## The warning was here a year ago; Google just validated the curve with engineering budget\n\nPull the timeline back one year: TechCrunch reported in July 2025 that the security researcher community was already discussing how AI slop poses a systemic risk to bug bounty programs. Back then, Google didn't act. This pause is effectively the industry admitting that the bounty model — after generative AI went mainstream — hit an inflection point where marginal report value fell below marginal triage cost. When AI drives submission cost to near zero, triage cost scales superlinearly. Google validated that curve with engineering budget.\n\n## Where the boundary lies: Cloud VRP stays open, OSS VRP narrows\n\nNotably, Cloud VRP remains as an exception. Google simultaneously stated that for some code repos that may affect Google Cloud products, product vulnerability reports can still go through Cloud VRP. In other words, Google hasn't fully closed the door — it has narrowed the OSS VRP entry that was originally open to the entire open source ecosystem, and selectively kept the commercial cloud surface live. Where that line is drawn, and whether it expands or contracts later, will be the key variable the security community watches next.\n\n## So what\n\nFor developers and white hats, this delivers a hard-to-ignore reminder: when generative AI drives the cost of submission to zero, what becomes scarce is the cost of verification. Google used a halt to new submissions to recalibrate that curve, but the cost still lands on the very small number of people who still hand-run fuzzers, read CVEs, and write PoCs. When the next wave of AI agents can close the loop on "find vulnerability + verify vulnerability + write compliant report", this pause may turn out to be just a guardrail before a much larger reset.