The Product Column Is a Dash. Google Said Automated.

At 15:17 UTC on 30 September, Google committed "OSS VRP product vuln pause" to the public rules for its Open Source Software Vulnerability Reward Program. The notice says that as of 1 October 2026 the program no longer accepts product vulnerability submissions. In the same commit the product row of the reward table becomes a dash on every tier.

Hacker News on 6 October led with Mistral Large 4, a physics prize, and EmbeddingGemma 2. US X trends were football, a singer, and a model launch. The operator record is the rules commit, plus the post Google VRP published the next afternoon.

Medium The paid intake for product bugs in Google's open source is closed. Supply chain reports stay. Medium because the disclosure path changed, and because Google did not publish a count or a confirmed cause beyond automated submissions.

What the rules commit changed.#

Commit f8bf23ad edits one file, the OSS VRP rules. It inserts this notice above the product-vulnerability section:

"As of October 1, 2026, we are no longer accepting product vulnerabilities submitted to the OSS VRP. For some Google Cloud repos impacting Google Cloud products we may still accept reports covering product vulnerabilities through the Cloud VRP. We will continue to reformat and work on this aspect of the OSS VRP and commit to giving an update in Q1 2027. In the meantime, we encourage you to find impact across our other VRP programs and submit there instead, or pursue the Patch Rewards Program. This change does not affect product vulnerabilities submitted before October 1, 2026."

The same diff replaces the product payouts. Flagship (OT0) had been $500 to $7,500. Important (OT1) had been $101 to $3,133.7. Both cells are now a dash. Standard and low-priority were already a dash. Supply chain compromises are untouched: $3,133.7 to $31,337 on flagship, $1,337 to $13,337 on important, $500 to $3,133.7 on standard. "Other security issues" still lists $1,000 and $500 on the first two tiers.

The paragraph under the notice still describes what a product vulnerability is, and still says that class is in scope. The notice and the dash are the change. The scope sentence was not deleted.

The rules clock and the intake clock.#

The package clock is the commit, 15:17 UTC on 30 September. That is when the notice and the dash landed in the rules file. The effective date written in the notice is 1 October.

The intake clock is the post. At 16:00 UTC on 1 October, Google VRP wrote that it is temporarily no longer accepting OSS VRP product vulnerability submissions, that this does not affect supply chain reports or outstanding reports, and that the pause is due to "a significant rise in automated submissions, the vast majority of which are not valid." BleepingComputer carried those sentences on 5 October. The Hacker News carried them on 6 October and added the caution: no figures, and no statement that the submissions were produced with AI tools.

The rules notice never uses the word temporary. The X post does. The rules notice never uses the word automated. The X post does. What both share is the date, 1 October, and the instruction to use other programs or Patch Rewards in the meantime.

1. 2026-09-30
   15:17 UTC: commit f8bf23ad, OSS VRP product vuln pause. The product reward row becomes a dash. Supply chain amounts stay.
2. 2026-10-01
   The notice's effective date. 16:00 UTC: Google VRP says the product pause is temporary, cites automated submissions, and leaves supply chain reports and outstanding reports in place.
3. 2026-10-05
   BleepingComputer quotes the post under a headline that says AI spam. The quoted sentences say automated.
4. 2026-10-06
   The Hacker News notes the missing count and that Google did not say the submissions were produced with AI tools.

What this is not.#

It is not a shutdown of supply chain reports. The X post says those are unaffected, and the reward table in the commit still lists supply chain amounts.

It is not a finding that the invalid reports were model-written. Google wrote automated. Press headlines added AI. Brief the verb Google used.

It is not a statement that product bugs stopped existing. The notice stops a paid intake. A bug in Go, Angular, or Protocol Buffers is still a bug. The path that paid for the report is what closed.

It is not a Cloud VRP ruling for every repository. The notice says Google may still accept product reports through Cloud VRP for some Google Cloud repos that affect Cloud products. Check that program's rules before you route a report there.

What to do.#

1. If your team files product vulnerabilities in Google open source through the OSS VRP, stop expecting that form to take a new one. The notice is effective 1 October. Reports submitted before that date are unchanged.
2. Keep filing supply chain reports. The post says the pause does not affect them. The table still prices that row. A dependency compromise is a different ticket from a product bug, and this change did not close it.
3. Read "may still" on Cloud VRP as a maybe. Use it when the repository affects a Google Cloud product and that program's rules agree. Do not assume every Google open source repo qualifies.
4. Use the Patch Rewards Program when you have a fix rather than a report the OSS VRP will no longer take. The notice names that program on purpose.
5. Do not put "AI slop" in the incident note unless you have a source besides a headline. The primary sentences say automated, mostly invalid, no count. The Hacker News flag on 6 October is the correction.
6. Do not wait for Q1 2027 to tell the project about a product bug you already have. The update is a promise to describe the program again. It is not a date the dash turns back into a range.

The rules clock stopped at 15:17 UTC on 30 September, when the product column became a dash. The intake clock is the 1 October post: temporary, automated, supply chain still open. The next date Google actually committed to is an update in Q1 2027.