💰 BUSINESS & FUNDING
- Google pauses open-source bug bounty over invalid AI-generated reports
Google paused product-vulnerability submissions to its OSS VRP bug bounty program.- The pause affects security researchers submitting product vulnerabilities in Google’s open-source software.
- Google halted OSS VRP product-vulnerability submissions on October 1 after a surge in automated reports, most of which were invalid or hallucinated.
- Supply-chain reports and previously submitted vulnerabilities remain active, while eligible Google Cloud issues can use the Cloud VRP.
- Google said it will restructure the program and provide an update in the first quarter of 2027.