Google suspends OSS VRP due to invalid reports from AI

Google announced that it decided to suspend Google OSS VRP due to the increase in artificial intelligence-supported invalid reports. The company has temporarily suspended this program, which rewards researchers who report security vulnerabilities in open source software projects.

This decision was taken as a result of the system being flooded with inaccurate notifications produced by artificial intelligence and far from reality. Security experts and project managers stated that they had difficulty in dealing with this intense and invalid report traffic.

Reason for Suspending the Program

In the official statement made by Google on October 1, it was emphasized that the current operation of the program has become unsustainable. The company stated that erroneous reports, called hallucinations, especially created using artificial intelligence tools, prevent the detection of real security vulnerabilities.

Continuing the program in this way both slowed down the review processes and caused inefficient use of resources. This situation negatively affected the basic functionality of the system established to ensure the security of open source projects.

The fact that artificial intelligence models make non-existent security vulnerabilities appear to exist has placed a serious burden on the program's control mechanisms. Cleaning up such content began to consume a lot of time for teams that should have been focusing on real vulnerabilities.

Restructuring that will last until 2027

Google has begun an extensive effort to restructure this aspect of the program and make it more efficient. The company stated that participants can continue to review other active VRP programs during this period.

A new update about the current status of the program is aimed to be shared in the first quarter of 2027. During this period, it is planned to make the system more resistant to artificial intelligence-generated spam submissions.

In the open source world, reporting security vulnerabilities quickly plays a critical role in protecting the software ecosystem. However, misuse of automation tools can seriously disrupt the functioning of such reward programs.

This decision made by Google had wide repercussions in the cyber security community and brought about discussions about the future of similar programs. Security researchers are focusing on how to strengthen the control mechanisms of content produced with artificial intelligence.

The company argues that this extended suspension is necessary for the long-term health of the program. The improvements to be made until 2027 aim to ease the workload of both researchers and project managers.