Google Pauses Open Source Vulnerability Rewards Program Due to Automated Submissions

Google has paused its Open Source Vulnerability Rewards Program (OSS VRP) due to a significant rise in automated submissions, the vast majority of which are not valid. The program rewards researchers for discovering vulnerabilities in open source projects, including Golang, Angular, and Fuchsia. The pause does not impact reports on the software supply chain or outstanding reports, and researchers are encouraged to submit to other VRP programs or the Patch Rewards Program instead.

The company explains that the pause is due to the overwhelming number of invalid or erroneous reports, including hallucinations generated by AI. Google’s engineers and open source project maintainers were overwhelmed by the sheer volume of reports, which included many gross errors.

The OSS VRP was launched in August 2022 and rewards researchers with sums ranging from $100 to $31,337 for discovering vulnerabilities in covered projects.