Google Froze Its OSS Bug Bounty Until 2027 — and the AI-Slop Wave That's Rewriting Who Gets Paid to Find Flaws

Google's announcement on October 1, 2026 stopped only one lane of the Open Source Software Vulnerability Reward Program: new product-vulnerability submissions for open-source projects under Google's portfolio. Three channels stay open: supply-chain reports (the higher-value category that targets dependency-confusion and build-system compromises), outstanding reports already filed before the cutoff, and reports for select Google Cloud repos that can still go through the separate Cloud VRP. The Google VRP team posted on X that the pause is due to a \"significant rise in automated submissions, the vast majority of which are not valid,\" and committed to a program update by Q1 2027.

The carve-outs reveal Google's priorities. Supply-chain reports — the kind that catch the next Log4j-style dependency attack — remain in scope precisely because those reports are harder to fake: they require a working proof-of-concept against a real build pipeline. The product-vulnerability channel is where low-effort AI sweeps thrive, because a generic prompt can produce a syntactically plausible report against almost any public repo.

Curl's curve is the cleanest dataset available, and the slope is steep: roughly 15% of submissions were genuine vulnerabilities in the program's first five years, falling to under 5% by mid-2025 even as submission volume roughly doubled. Dark Reading's reporting on the HackerOne IBB pause cited the same one-in-twenty ratio for open-source programs broadly, and a separate arXiv analysis of bug-bounty invalid-reason trends found that AI-generated submissions on HackerOne jumped 294% year-over-year through 2025. The signal-to-noise collapse is the proximate cause of every program freeze in this cycle.

The OSS line is small in dollar terms — $327,672 is less than 2% of Google's $17.1M VRP total — but it punches above its weight in policy influence: it sets the floor on what every other open-source maintainer is expected to offer researchers. Freezing it tells the market that even Google's tolerance for false positives has run out, and every smaller OSS project that relies on the implied benchmark is now under informal pressure to either harden their intake process or follow curl's lead and exit.

When human-mediated bug bounties shrink, the dollars don't disappear — they migrate to two adjacent markets. The first is consolidated enterprise security platforms that bundle vulnerability management with detection and response, priced as ARR rather than as a per-finding bounty. The second is AI-native static analysis tools that can pre-filter the slop before a maintainer ever reads it, monetized as seat licenses or API calls. Both categories directly absorb the economic slack from the OSS VRP freeze.

Over days to quarters, the immediate consequence is reputational rather than financial. Google's pause is narrow enough that the $327,672 OSS line won't move any earnings needle — Alphabet's Q2 2026 print of $119.8B in revenue (+24% YoY) and $40.8B in operating income makes the bounty a rounding error. The more measurable near-term impact falls on HackerOne and the smaller open-source projects that depended on its Internet Bug Bounty bridge funding: Node.js's pause in April 2026 demonstrated that pattern already playing out.

Over one to three years, the structural shift is bigger. The AI vulnerability scanning market was sized at $3.58B in 2026 and is projected to reach $6.62B by 2030 at a 16.7% CAGR (Research and Markets, 2026) — but the more telling data point is HackerOne's own finding that valid AI-related vulnerability reports grew 210% even as overall submission noise surged. The bottleneck is no longer finding bugs; it is qualifying them. Whoever owns the qualification step — whether a platform vendor like Microsoft embedding Defender into GitHub, or an AI-native scanner like ZeroPath, or an enterprise platform like Palo Alto Networks — captures the margin that used to accrue to individual researchers. The next milestone to watch is Google's promised Q1 2027 update on whether the OSS VRP reopens in a redesigned form; that decision will signal whether the human-disclosure model is repairable or structurally obsolete.