Google announced that it has suspended the Google OSS VRP program due to an increase in AI-generated invalid reports. The company has temporarily suspended this program, which rewards researchers who report security vulnerabilities in open-source software projects. This decision was made because the system was overflowing with AI-generated, unrealistic, and inaccurate reports. Security experts and project managers stated that they were struggling to cope with this heavy volume of invalid reports.

Reason for Program Suspension

In an official statement made by Google on October 1st, it was emphasized that the current operation of the program had become unsustainable. The company stated that false reports, referred to as hallucinations, generated particularly using AI tools, prevented the detection of real security vulnerabilities.

The AI ​​​​models presenting non-existent security vulnerabilities as if they existed placed a significant burden on the program’s control mechanisms. Cleaning up this type of content began to consume a large amount of time for teams that should have been focusing on real security vulnerabilities.

Restructuring to Continue Until 2027

Google has launched a comprehensive study to restructure and improve this aspect of the program. The company stated that during this process, participants can continue to examine other effective VRP programs.

A new update on the current status of the program is expected to be shared in the first quarter of 2027. During this time, the system is planned to be made more resilient against AI-generated spam.

In the open-source world, the rapid reporting of vulnerabilities plays a critical role in protecting the software ecosystem. However, the misuse of automation tools can significantly disrupt the functioning of such reward programs.

Google’s decision has caused widespread repercussions in the cybersecurity community and has sparked discussions about the future of similar programs. Security researchers are focusing on how to strengthen the control systems for AI-generated content.

The company argues that this long-term suspension is necessary for the long-term health of the program. The improvements to be made by 2027 aim to lighten the workload of both researchers and project managers.

Do you think these AI-generated medical misreports could threaten other cybersecurity reward programs in the future?

Google announced the suspension of Google OSS VRP due to AI-generated invalid reports. The program will remain closed until 2027.