[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"news-slug-google-oss-vrp-pause-ai-slop-reports":3,"topics-all":38,"news-related-7809c36c-7ae0-409e-bb68-4c977b5f2a41":57},{"id":4,"title":5,"summary":6,"content":7,"original_url":8,"source_id":9,"tags":10,"translations":24,"news_slug":31,"published_at":32,"created_at":33,"modified_at":34,"is_published":35,"publish_type":36,"image_url":14,"view_count":37},"7809c36c-7ae0-409e-bb68-4c977b5f2a41","AI 幻觉报告泛滥 谷歌冻结开源漏洞悬赏计划","10 月 1 日,谷歌暂停开源软件漏洞奖励计划(OSS VRP),理由是自动化提交「显著上升」且绝大多数是 AI 幻觉报告,承诺 2027 Q1 更新。Cloud VRP 作为 Google Cloud 相关接收通道保留。","10 月 1 日,谷歌正式叫停了运行多年的开源软件漏洞奖励计划(OSS VRP),理由只有一句话:自动化提交的数量出现了「显著上升」(a significant rise),其中绝大多数根本不是有效报告。这不是临时维护,而是 Google 在 X 和 bughunters.google.com 同步挂出的暂停通知——承诺在 2027 年第一季度给出更新,期间研究人员被引导去尝试 Google 的其它漏洞奖励计划。\\n\\n## 不是「AI 滥用」抽象叙事,是工时被啃光的现实\\n\\nOSS VRP 是 Google 设立来激励安全研究人员在公司整个开源生态中挖掘并负责任披露漏洞的项目,产品漏洞提报和 Google Cloud 仓库的相关报告都通过它走。和大多数 bug bounty 不同,OSS VRP 处理的是 Google 主导或重度依赖的开源代码,一旦真出了 CVE,影响面会被整个开源社区一起承担。所以 Google 这次选择「暂停」而不是「改造规则」,本身就是一个不寻常的姿态。\\n\\n触发暂停的不是抽象的「AI 滥用」叙事,而是具体到人和工时的问题。Tom's Hardware 援引知情人士的说法:Google 工程师和开源项目维护者已经被数以千计的低质量报告彻底压垮——这些报告声称发现了严重漏洞,但排查后全是 AI 生成的「幻觉」,既不能复现也无法被实际利用。维护者不得不把大量精力花在「验证一份看似严谨但完全是模型编出来的报告」上,真正高危漏洞的修复时间被严重挤压。整个行业存在同样的问题,Google 不是孤例,只是把开关按下得最决。\\n\\n## 一年前已经有预警,Google 用工程预算把曲线验出来\\n\\n把时间线往上拨一年,TechCrunch 在 2025 年 7 月就报道过类似现象——安全研究员社区已经在讨论 AI slop(AI 垃圾)给 bug bounty 生态带来的系统性风险。Google 那时没有动作,这次叫停其实是在替整个行业承认:悬赏模型在生成式 AI 普及后,出现了「边际报告收益\u003C边际审核成本」的拐点。当提交成本被 AI 压到几乎为零,审核成本就被指数式放大,这条曲线 Google 用工程预算验证了一遍。\\n\\n## 边界划在哪:Cloud VRP 留着,OSS VRP 收窄\\n\\n更值得注意的是 Cloud VRP 留下的豁口。Google 同时声明:针对部分可能影响 Google Cloud 产品的代码仓库,如果涉及产品漏洞,仍可通过 Cloud VRP 接收相关报告。换句话说,Google 没有完全关上门,只是把 OSS VRP 这条原本对所有开源生态开放的入口收窄——「Google 直接暴露在开源生态里的攻击面」这一档被选择性放下,商业云相关的部分保留。这条边界划在哪里、以后会不会再扩或再缩,会是接下来安全社区盯着的关键变量。\\n\\n## 所以呢\\n\\n对开发者和白帽来说,这件事给出了一个很难忽视的提示:**当生成式 AI 把「提交」门槛降到了零,真正稀缺的就变成了「谁能验证」。** Google 用停止接收新报告来重新校准这条曲线,但成本最终还是会落到极少数还在手工跑模糊测试、读 CVE、写 PoC 的人头上。等到下一轮 AI agent 能闭环跑通「找漏洞+验证漏洞+写合规报告」时,这一轮暂停也许只是更大规模重置前的护栏。","https:\u002F\u002Fwww.tomshardware.com\u002Ftech-industry\u002Fartificial-intelligence\u002Fgoogle-suspends-part-of-the-oss-vrp-bug-bounty-program-due-to-an-influx-of-invalid-ai-submissions-product-vulnerability-submissions-ended-october-1","2ea3b602-f810-4167-b1ea-b56c5de103f8",[11,15,18,21],{"id":12,"name":13,"slug":13,"description":14,"color":14},"c33b1bbc-d6ce-4f61-9d5d-1a0704a6a09b","ai-policy",null,{"id":16,"name":17,"slug":17,"description":14,"color":14},"1fcfaaf2-67de-43d3-9e35-5784852fec60","ai-safety",{"id":19,"name":20,"slug":20,"description":14,"color":14},"8cf7490f-2449-4ba7-be19-61befa0d92b4","google",{"id":22,"name":23,"slug":23,"description":14,"color":14},"02bfdc0f-5e23-4fbb-b31a-7cc03cdba1ee","security",[25],{"id":26,"lang":27,"title":28,"summary":29,"content":30},"85255175-349a-4fcc-99da-f42a86dd98b7","en","Google Freezes OSS VRP as AI Slop Reports Drown Maintainers","Google paused OSS VRP on Oct 1 over a surge of AI-hallucinated bug reports. Cloud VRP stays open for Google Cloud repos.","On October 1, Google officially paused its long-running Open Source Software Vulnerability Reward Program (OSS VRP), citing a single reason: a \"significant rise\" in automated submissions, the vast majority of which are not valid. The notice went up simultaneously on bughunters.google.com and Google's X account — Google is promising an update in Q1 2027, and in the meantime, researchers are being nudged toward Google's other bug bounty programs.\\n\\n## Not an abstract AI-misuse story, just hours being eaten alive\\n\\nOSS VRP was set up to incentivize independent security researchers to find and responsibly disclose vulnerabilities across Google's open source ecosystem; product vulnerability submissions and reports against Google Cloud code repos both flow through it. Unlike most bug bounties, OSS VRP covers code that Google either owns or heavily depends on — when a CVE lands here, blast radius propagates through the whole open source stack. The fact that Google chose to \"pause\" rather than \"tweak the rules\" is itself an unusual posture.\\n\\nWhat triggered the pause isn't some abstract \"AI misuse\" narrative — it's a concrete people-and-hours problem. According to sources cited by Tom's Hardware, Google engineers and open source maintainers have been completely overwhelmed by thousands of low-quality reports that claim to surface severe vulnerabilities but, after triage, turn out to be AI-generated hallucinations that are neither reproducible nor exploitable. Maintainers have had to spend enormous effort validating reports that look rigorous but are entirely fabricated by models; time on real high-severity fixes gets squeezed. The same problem exists across the industry, and Google isn't the first — just the firmest to flip the switch.\\n\\n## The warning was here a year ago; Google just validated the curve with engineering budget\\n\\nPull the timeline back one year: TechCrunch reported in July 2025 that the security researcher community was already discussing how AI slop poses a systemic risk to bug bounty programs. Back then, Google didn't act. This pause is effectively the industry admitting that the bounty model — after generative AI went mainstream — hit an inflection point where marginal report value fell below marginal triage cost. When AI drives submission cost to near zero, triage cost scales superlinearly. Google validated that curve with engineering budget.\\n\\n## Where the boundary lies: Cloud VRP stays open, OSS VRP narrows\\n\\nNotably, Cloud VRP remains as an exception. Google simultaneously stated that for some code repos that may affect Google Cloud products, product vulnerability reports can still go through Cloud VRP. In other words, Google hasn't fully closed the door — it has narrowed the OSS VRP entry that was originally open to the entire open source ecosystem, and selectively kept the commercial cloud surface live. Where that line is drawn, and whether it expands or contracts later, will be the key variable the security community watches next.\\n\\n## So what\\n\\nFor developers and white hats, this delivers a hard-to-ignore reminder: **when generative AI drives the cost of submission to zero, what becomes scarce is the cost of verification.** Google used a halt to new submissions to recalibrate that curve, but the cost still lands on the very small number of people who still hand-run fuzzers, read CVEs, and write PoCs. When the next wave of AI agents can close the loop on \"find vulnerability + verify vulnerability + write compliant report\", this pause may turn out to be just a guardrail before a much larger reset.","google-oss-vrp-pause-ai-slop-reports","2026-10-06T03:00:00Z","2026-10-06T05:07:45.122172Z","2026-10-06T05:07:45.122184Z",true,"agent",143,[39,48],{"slug":40,"tag_slug":40,"title_zh":41,"title_en":42,"intro_zh":43,"intro_en":44,"id":45,"is_active":35,"created_at":46,"modified_at":47},"ai-for-science","AI for Science 2026：从 UniPert 到 GPT-Rosalind 的硬核进化","AI for Science 2026: from UniPert to GPT-Rosalind","生命科学、化学材料、物理世界模型——AI 正在从\"语言工具\"变成\"实验伙伴\"。本专题收录 AI 在三大科学方向的关键节点：UniPert 统一基因与化学扰动空间、GPT-Rosalind 端到端生命科学推理、达摩院 AI 智能体 28 小时找到 4 种超导新材料、Anthropic Claude Science 把工作台做成标准品。","From language tool to lab partner — AI is reshaping life sciences, chemistry\u002Fmaterials, and physical world models. This topic covers the key milestones: UniPert unifying genetic-chemical perturbation spaces, GPT-Rosalind's end-to-end life-sciences reasoning, DAMO's AI agent discovering 4 superconducting materials in 28 hours, and Anthropic's Claude Science workbench going mainstream.","988a4300-5fab-41c4-b5d8-63711a2dc757","2026-09-10T01:34:15.296649Z","2026-09-10T01:34:15.296663Z",{"slug":49,"tag_slug":49,"title_zh":50,"title_en":51,"intro_zh":52,"intro_en":53,"id":54,"is_active":35,"created_at":55,"modified_at":56},"h3-series","MiniMax H3 系列：从开源权重到 35 倍吞吐","MiniMax H3 Series: from open weights to 35x throughput","MiniMax H3 自 2026 年 8 月开源以来节奏密集：官方把生成、参考与编辑收回一个模型；ComfyUI 当天压进 RTX 3060；摩尔线程 3 小时完成国产 GPU 适配；fal 后训练版把吞吐拉到 35 倍；FastH3 蒸馏再砍推理成本。本专题持续追踪 H3 的发布—开源—蒸馏—部署全链路。","Since MiniMax open-sourced H3 in August 2026 the pace has been relentless: one unified omni-modal model, same-day ComfyUI support down to an RTX 3060, a 3-hour Day-0 port to Moore Threads GPUs, fal's post-trained H3 Max at 35x throughput, and FastH3 distillation cutting inference cost further. This topic tracks the full H3 chain — release, open weights, distillation, deployment.","83ef0daa-3c31-4cb3-86ed-e5ee58654d5f","2026-09-08T07:33:19.942193Z","2026-09-08T07:33:19.942209Z",{"items":58},[59,64,69,74,79,84],{"id":60,"title":61,"news_slug":62,"published_at":63},"c2c96e3a-cc8d-4970-8d9d-e9584bbc9237","WhatsApp 帮助页藏 102 块 LLM 暗指令","whatsapp-hidden-llm-instructions-help-pages","2026-10-19T16:00:00+00:00",{"id":65,"title":66,"news_slug":67,"published_at":68},"5796d012-e921-4760-b58f-653b90c151b1","Claude 削攻击面:25 个开源项目 493 处问题","claude-attack-surface-reduction-openssh","2026-10-22T05:20:00+00:00",{"id":70,"title":71,"news_slug":72,"published_at":73},"b485d30c-0640-4349-aa6f-69bdd9d3e935","Meta 撤回条款中抓取训练条款,出版商赢得一次窄胜利","meta-withdraws-ai-training-clause-terms","2026-10-21T07:10:00+00:00",{"id":75,"title":76,"news_slug":77,"published_at":78},"488f30b2-34b1-48e4-b67f-9187f15c1a71","AI 抢先挖出 PHP 漏洞，披露窗口先被自己人捅破","openai-php-rce-coordinated-disclosure","2026-10-21T06:00:00+00:00",{"id":80,"title":81,"news_slug":82,"published_at":83},"de7af8cd-8c1c-4872-a0ff-ba2ca81ed5cc","Open Source Summit Europe 现场:Linux 阵营亲 AI,BSD 反 AI 阵营冲上 12 万美元捐款","oss-eu-prague-linux-vs-bsd-ai","2026-10-17T01:00:00+00:00",{"id":85,"title":86,"news_slug":87,"published_at":88},"b514c2a2-1d99-4666-8e78-588bb08e2979","Google 冻结 OSS VRP:AI 报告把维护者压垮","google-oss-vrp-ai-slop-pause","2026-10-12T02:00:00+00:00"]