Google's rules page for the Open Source Software Vulnerability Reward Program now states that submissions stopped as of October 1, 2026, with an update promised sometime in the first quarter of 2027. TechCrunch reported the freeze followed a rise in automated and AI-generated reports flooding the intake queue. That is the confirmed trigger, as described by reporting and echoed in the program's own posted text. Google has not published volume numbers, has not named which automated tools were involved, and has not said whether the pause covers all open source projects under the VRP umbrella or a subset.
For platform teams, the open source VRP has functioned as a secondary discovery channel: researchers find a flaw in a dependency, Google pays out, a fix lands upstream, and downstream consumers get a patch or an advisory. Freeze that intake and the discovery side does not stop, but the triage and reward mechanism that incentivizes fast, verified disclosure goes quiet for an unknown stretch. Nothing in the posted rules says whether Google will backfill submissions made during the freeze once the program resumes, or whether reports sent during the gap are being read at all.
The mechanism worth tracking is incentive collapse, not just paperwork. Bug bounty programs work because researchers trust that a valid report gets money and a timeline. A months-long pause, even a well-telegraphed one, pushes some of that research toward other venues: private disclosure to maintainers directly, sale to brokers, or public posting with no coordinated patch window. None of those paths move faster than the program did. Google's own text commits to nothing beyond a Q1 2027 check-in, so the realistic planning window for on-call teams is four to six months of reduced visibility into newly reported open source flaws that would otherwise have surfaced through this pipeline.
On-call engineers who track open source dependencies should check two things now. First, confirm whether any internal vulnerability feeds, SBOM tooling, or security team dashboards cite Google's OSS VRP as a data source, directly or through an aggregator, and flag that source as paused rather than silent-but-functioning. Second, treat the freeze as a reason to lean harder on upstream project mailing lists, CVE feeds, and direct maintainer channels for the dependencies that matter most to production, since the VRP gap does not pause the libraries themselves, only one path by which flaws in them get reported and rewarded.
Separate what is confirmed from what is reported. Confirmed, by Google's own rules page: submissions stopped October 1, an update is promised for Q1 2027. Reported, via TechCrunch: the cause was a rise in automated or AI-generated submissions overwhelming the program. Not disclosed anywhere in the cited material: submission volume, which projects are affected, or whether existing unresolved reports filed before October 1 are still being processed. Anyone running infrastructure that depends on open source packages should assume the program is dark until Q1 2027, not quieter.