Vulnerabilities
Google Pauses OSS VRP Due to AI-Generated Submissions
Google has temporarily paused submissions to its Open Source Vulnerability Reward Program (OSS VRP) due to a surge in low-quality, largely AI-generated vulnerability reports. This follows similar actions by other projects like curl and Intel, highlighting a growing challenge in vulnerability disclosure programs. Defenders should anticipate similar disruptions and prepare for increased triage demands.
What Happened
Google has paused the intake of new vulnerability reports for its Open Source Vulnerability Reward Program (OSS VRP). This action is a direct response to a significant increase in submissions that are largely automated and invalid. The influx of these reports, primarily generated by AI tools, is overwhelming Google’s security team and diverting resources from legitimate vulnerability investigations.
Impact
The primary impact is a slowdown in the review process for genuine vulnerabilities. Security teams are forced to spend time validating and dismissing AI-generated reports, reducing their capacity to address critical security flaws. This trend also affects other bug bounty programs, as demonstrated by similar pauses or changes to curl and Intel’s programs. The core issue isn't AI finding vulnerabilities, but the economic shift in reporting costs – it’s now cheaper to submit potentially flawed reports at scale.
What to Do
Organizations operating bug bounty programs or receiving vulnerability reports should consider the following:
- Implement stricter submission requirements: Mandate detailed proof-of-concept (PoC) submissions and higher evidence thresholds.
- Introduce rate limiting: Control the volume of submissions from individual researchers or IP addresses.
- Automated triage: Explore AI-powered tools to assist in initial triage and deduplication of reports.
- Focus on validation: Prioritize engineering time on reports that demonstrate clear validity and impact.
Long-Term Considerations
The challenge isn’t stemming from AI “breaking” vulnerability disclosure, but rather exposing weaknesses in the economics of disclosure. The cost to file a report has decreased, while the cost to validate it remains high.
Future solutions likely involve leveraging AI to pre-validate submissions, filtering out low-quality or duplicated reports before they reach human reviewers. While this may frustrate some researchers, it’s a necessary step to maintain program efficiency and focus on actionable vulnerabilities.
Related vulnerabilities
Google Pauses OSS Vulnerability Reward Program Amid Surge of Invalid Automated Submissions
Google has temporarily halted acceptance of product vulnerability reports in its Open Source Software Vulnerability Reward Program (OSS VRP) after a spike in automated, largely invalid submissions. The pause does not affect supply‑chain reports or existing submissions, and product vulnerabilities for Google Cloud may still be reported through the Cloud VRP.
Read briefing
AI-Generated Vulnerabilities Skew Toward Remote Code Execution, Google Report Finds
Google’s Threat Intelligence Group reports that vulnerabilities discovered with AI are increasingly capable of remote code execution. Monthly disclosures and high‑risk findings have both doubled in 2026, raising the urgency for rapid patching and enhanced monitoring.
Read briefing
VMware Workstation VMXNET3 Integer Overflow (CVE-2026-59346)
A local privilege escalation vulnerability exists in VMware Workstation due to an integer overflow in the VMXNET3 virtual device. Successful exploitation requires prior high-privileged code execution within the guest OS. Defenders should apply the vendor-provided patch immediately.
Read briefing
CVE-2026-102231: Visual Studio Code Path Equivalence Bypass Vulnerability
A local security feature in Visual Studio Code can be bypassed due to improper path equivalence resolution, allowing attackers to gain unauthorized access to protected resources. The flaw affects all installations that rely on the feature, and defenders should update to the latest version and verify path handling.
Read briefing