Beyond restricting which Gemini models free and AI Plus users can use, Google has also announced that it is hitting pause on the Open Source Software Vulnerability Reward Program (OSS VRP). It’s only this specific bug bounty program that’s being paused, as the internet search giant still recommends bug bounty hunters contribute to other programs, such as the Cloud and AI VRPs, as well as “pursue the Patch Rewards Program”.
The reason for the temporary freeze? According to the announcement, this “is due to a significant rise in automated submissions, the vast majority of which are not valid”. Tom’s Hardware expands on this, noting that “Google engineers and open-source maintainers were reportedly being overwhelmed by thousands of these poorly written reports that claimed to find bugs but were actually completely invalid or unexploitable hallucinations. They ended up spending too much time manually validating code instead of actually fixing real, critical vulnerabilities”.
