Google Pauses OSS VRP Product-Vulnerability Rewards After Automated Report Surge
Google stopped paying product-vulnerability rewards in its Open Source Software Vulnerability Reward Program as of 1 October 2026. Officials cited a surge in automated submissions, most of them invalid.
Google's Open Source Software Vulnerability Reward Program (OSS VRP) stopped paying rewards for product-vulnerability reports as of 1 October 2026.
Officials attributed the change to a surge in automated submissions. Most of those filings were invalid.
Program history after Log4j
Google launched OSS VRP in August 2022, after the Log4j incident. Package registries including Maven, NPM, and PyPI had seen repeated supply-chain failures. The program funded research on core open-source projects on that supply side.
The top listed payout was $31,337. In 2025, OSS projects received $327,672 in rewards.
Four sensitivity tiers
In March 2026, OSS VRP grouped covered Google open-source projects into four sensitivity tiers:
- Flagship (OT0): 26 projects. Representative projects include Go, Angular, Flutter, Bazel, and Protocol Buffers.
- Important (OT1): 47 projects.
- Standard (OT2): a large set of medium-priority projects.
- Low priority (OT3): no public rewards.
In April 2026, Google stopped bounties and public acknowledgements for product vulnerabilities and other security issues on OT2 and OT3.
Reward schedule as of 1 October 2026
Product-vulnerability rewards are now zero on the remaining paid tiers. Supply-chain compromise still pays.
Supply-chain compromise
- OT0 (Flagship): $3,133.7 to $31,337
- OT1 (Important): $1,337 to $13,337
- OT2 (Standard): $500 to $3,133.7
- OT3 (Low priority): no listed reward
Product vulnerability
- OT0: 0 (previously $500 to $7,500)
- OT1: 0 (previously $101 to $3,133.7)
- OT2 and OT3: no listed reward
Other security issues
- OT0: $1,000
- OT1: $500
- OT2 and OT3: no listed reward
AI-generated volume and maintainer funding
The pause follows growth in AI-generated reports and in low-quality or invalid filings. Maintainers outside Google report similar load.
In March 2026, the Linux Foundation said it had received $12.5 million from technology companies. Alpha-Omega and OpenSSF manage the funds. Stated uses include helping maintainers handle AI-accelerated vulnerability discovery, filtering low-quality reports, and verifying and fixing real bugs.
Google's change matches a cost shift: generating vulnerability leads and write-ups is cheaper, while triage, verification, and repair still consume reviewer time.
Program notes and rules: https://x.com/GoogleVRP/status/2105689195180179605 and https://bughunters.google.com/about/rules/open-source/google-open-source-software-vulnerability-reward-program-rules