Google halts open-source bug bounty program amid AI spam surge

Automated reports just closed a bug bounty. Google paused product vulnerability submissions to its Open Source VRP on October 5, citing a rise in automated submissions “the vast majority of which are not valid” — this for a programme that paid $17.1M to over 700 researchers in 2025. Supply chain reports and Patch Rewards stay open, with a reformat promised in Q1 2027. Triage capacity is the part of security nobody budgets for 😅