Google stated that it will use the downtime to restructure the submission framework, with an official progress update slated for the first quarter of 2027. The company announced the operational freeze in a post on X, directing security researchers toward its other active reward initiatives. Google has paused product vulnerability submissions for its Open Source Software Vulnerability Reward Program (OSS VRP) after a flood of invalid, AI-generated reports overwhelmed security engineers and repository maintainers.
Previously, Linux maintainers reported being completely flooded by bogus Common Vulnerabilities and Exposures (CVE) filings after automated AI hunters drove recorded vulnerabilities to a record high of 2,000 per release. The influx forced the Linux project to drop support for older network drivers.
Chipmaker Intel also recently froze its bug bounty program, which offered payouts reaching $100,000 per flaw. industry analysts widely attribute the shutdown to identical AI spam bottlenecks While Intel did not cite synthetic submissions as the official cause.