Google has paused product vulnerability submissions for its Open Source Software Vulnerability Reward Program (OSS VRP) after a flood of invalid, AI-generated reports overwhelmed security engineers and repository maintainers. The company announced the operational freeze in a post on X, took effect immediately on October 1, and directed security researchers toward its other active reward initiatives while it restructures the submission framework.

The suspension took effect immediately on October 1, but Google outlined specific exceptions to avoid shutting down critical disclosure channels. The pause does not affect valid product vulnerability filings logged before October 1, and the freeze applies specifically to product vulnerability reports; supply chain disclosures submitted under the OSS VRP remain open. Product vulnerability reports tied to Google Cloud repositories that directly impact Cloud products may still be accepted through the separate Google Cloud VRP.

The pause lands on a community already under financial and logistical strain. It's FOSS reports that DigitalOcean is quietly sunsetting its Open Source Credits program, citing an email Node.js maintainers received; no new applications, renewals, extensions, or additional credit requests will be approved, and the opensource@digitalocean.com inbox will no longer be monitored. Maintainers losing both hosting support and a reward channel face harder infrastructure bills while filtering AI slop from their queues.

Google stated it will continue to reformat and work on the OSS VRP and committed to giving a progress update in the first quarter of 2027. Until then, the company encourages researchers to find impact across its other VRP programs or pursue the Patch Rewards Program. Meanwhile, tooling meant to reduce maintainer load keeps arriving — InfoQ reports AWS open-sourced Pizza Bot, an inbox-style application for running AI agents in the background with human approval gates.