# The Product Column Is a Dash. Google Said Automated. > The primary is Google's OSS VRP rules commit at 15:17 UTC on 30 September 2026. From 1 October the program no longer accepts product vulnerability reports, and that reward row is a dash. Supply chain amounts remain. The next day's X post blames automated submissions, most of them invalid, with no count. Q1 2027 is the promised update. Source: https://hackerlogs.com/blog/google-oss-vrp-product-dash Published: 2026-10-06 ## Key takeaways - The primary is commit f8bf23ad on google/bughunters at 15:17 UTC on 30 September 2026. The message is OSS VRP product vuln pause. The notice inside it takes effect on 1 October. - The product vulnerability row is a dash on every tier. Flagship had been $500 to $7,500. Important had been $101 to $3,133.7. Supply chain amounts on the same table were not edited. - Google VRP's X post on 1 October says the pause is temporary and does not affect supply chain reports or reports already filed. It cites a rise in automated submissions, most of them invalid, and gives no count. - The rules notice does not say the reports were written by AI. The Hacker News, on 6 October, noted that the post gave no figures and did not say the submissions were produced with AI tools. - Q1 2027 is a commitment to an update. The notice does not give a date when product reports will be accepted again. Reports submitted before 1 October are unchanged. At 15:17 UTC on 30 September, Google committed "OSS VRP product vuln pause" to the public rules for its Open Source Software Vulnerability Reward Program. The notice says that as of 1 October 2026 the program no longer accepts product vulnerability submissions. In the same commit the product row of the reward table becomes a dash on every tier. Hacker News on 6 October led with Mistral Large 4, a physics prize, and EmbeddingGemma 2. US X trends were football, a singer, and a model launch. The operator record is the rules commit, plus the post Google VRP published the next afternoon. The paid intake for product bugs in Google's open source is closed. Supply chain reports stay. Medium because the disclosure path changed, and because Google did not publish a count or a confirmed cause beyond automated submissions. Three panels for the Google OSS VRP product pause: a 30 September rules commit that dashes the product reward row, a 1 October post that says automated, and a Q1 2027 update that is not a reopen date. ## What the rules commit changed. [Commit f8bf23ad](https://github.com/google/bughunters/commit/f8bf23ad82928bfa728214f20dc0af4fa13e310f) edits one file, the OSS VRP rules. It inserts this notice above the product-vulnerability section: "As of October 1, 2026, we are no longer accepting product vulnerabilities submitted to the OSS VRP. For some Google Cloud repos impacting Google Cloud products we may still accept reports covering product vulnerabilities through the Cloud VRP. We will continue to reformat and work on this aspect of the OSS VRP and commit to giving an update in Q1 2027. In the meantime, we encourage you to find impact across our other VRP programs and submit there instead, or pursue the Patch Rewards Program. This change does not affect product vulnerabilities submitted before October 1, 2026." The same diff replaces the product payouts. Flagship (OT0) had been $500 to $7,500. Important (OT1) had been $101 to $3,133.7. Both cells are now a dash. Standard and low-priority were already a dash. Supply chain compromises are untouched: $3,133.7 to $31,337 on flagship, $1,337 to $13,337 on important, $500 to $3,133.7 on standard. "Other security issues" still lists $1,000 and $500 on the first two tiers. The paragraph under the notice still describes what a product vulnerability is, and still says that class is in scope. The notice and the dash are the change. The scope sentence was not deleted. > The X post says automated, and that the vast majority were not valid. It does not say AI, and it does not give a count. BleepingComputer's 5 October headline says AI spam. The Hacker News, on 6 October, wrote that the post gave no figures and did not say the submissions were produced with AI tools. Supply chain reports are still in the program. ## The rules clock and the intake clock. The package clock is the commit, 15:17 UTC on 30 September. That is when the notice and the dash landed in the rules file. The effective date written in the notice is 1 October. The intake clock is the post. At 16:00 UTC on 1 October, [Google VRP](https://x.com/googlevrp/status/2105689195180179605) wrote that it is temporarily no longer accepting OSS VRP product vulnerability submissions, that this does not affect supply chain reports or outstanding reports, and that the pause is due to "a significant rise in automated submissions, the vast majority of which are not valid." [BleepingComputer](https://www.bleepingcomputer.com/news/google/google-halts-open-source-bug-bounty-program-amid-ai-spam-surge/) carried those sentences on 5 October. [The Hacker News](https://thehackernews.com/2026/10/google-pauses-oss-product-bug-bounty.html) carried them on 6 October and added the caution: no figures, and no statement that the submissions were produced with AI tools. The rules notice never uses the word temporary. The X post does. The rules notice never uses the word automated. The X post does. What both share is the date, 1 October, and the instruction to use other programs or Patch Rewards in the meantime. > Q1 2027 is an update, not a reopen. The notice commits Google to saying more in the first quarter of 2027. It does not name a day when product reports will be accepted again, and it does not say the dash will be restored. ## What this is not. It is not a shutdown of supply chain reports. The X post says those are unaffected, and the reward table in the commit still lists supply chain amounts. It is not a finding that the invalid reports were model-written. Google wrote automated. Press headlines added AI. Brief the verb Google used. It is not a statement that product bugs stopped existing. The notice stops a paid intake. A bug in Go, Angular, or Protocol Buffers is still a bug. The path that paid for the report is what closed. It is not a Cloud VRP ruling for every repository. The notice says Google may still accept product reports through Cloud VRP for some Google Cloud repos that affect Cloud products. Check that program's rules before you route a report there. ## What to do. 1. If your team files product vulnerabilities in Google open source through the OSS VRP, stop expecting that form to take a new one. The notice is effective 1 October. Reports submitted before that date are unchanged. 2. Keep filing supply chain reports. The post says the pause does not affect them. The table still prices that row. A dependency compromise is a different ticket from a product bug, and this change did not close it. 3. Read "may still" on Cloud VRP as a maybe. Use it when the repository affects a Google Cloud product and that program's rules agree. Do not assume every Google open source repo qualifies. 4. Use the Patch Rewards Program when you have a fix rather than a report the OSS VRP will no longer take. The notice names that program on purpose. 5. Do not put "AI slop" in the incident note unless you have a source besides a headline. The primary sentences say automated, mostly invalid, no count. The Hacker News flag on 6 October is the correction. 6. Do not wait for Q1 2027 to tell the project about a product bug you already have. The update is a promise to describe the program again. It is not a date the dash turns back into a range. The rules clock stopped at 15:17 UTC on 30 September, when the product column became a dash. The intake clock is the 1 October post: temporary, automated, supply chain still open. The next date Google actually committed to is an update in Q1 2027. ## Sources - [OSS VRP product vuln pause](https://github.com/google/bughunters/commit/f8bf23ad82928bfa728214f20dc0af4fa13e310f) (2026-09-30) - [Google Open Source Software Vulnerability Reward Program Rules](https://github.com/google/bughunters/blob/f8bf23ad82928bfa728214f20dc0af4fa13e310f/bughunters/articles/about/rules/open-source/google-open-source-software-vulnerability-reward-program-rules.md) (2026-09-30) - [PSA for open-source bug hunters](https://x.com/googlevrp/status/2105689195180179605) (2026-10-01) - [Google halts open-source bug bounty program amid AI spam surge](https://www.bleepingcomputer.com/news/google/google-halts-open-source-bug-bounty-program-amid-ai-spam-surge/) (2026-10-05) - [Google Pauses OSS Product Bug Bounty Rewards After Surge in Invalid Automated Reports](https://thehackernews.com/2026/10/google-pauses-oss-product-bug-bounty.html) (2026-10-06)