Picture an emergency room where every patient arrives holding a printout from a symptom checker, each one insisting with perfect grammar and confident formatting that they have a rare autoimmune disorder. The triage nurse cannot dismiss any of them outright. Each claim needs minutes of attention. The ones with actual broken bones wait behind a hundred well-worded hypotheses.
That is roughly what happened to Google’s Open Source Software Vulnerability Reward Program. On October 1, 2026, Google announced via an official X post that it was suspending product vulnerability submissions to the OSS VRP, pointing to an overwhelming influx of invalid AI-generated reports. Participants were nudged toward other VRP programs while the company reformats this part of the effort, with an update promised by the first quarter of 2027. Google also signaled it wants a more sustainable model for handling AI-assisted security research.
The program launched in 2022 as a way to pay researchers for finding flaws in the open source projects Google depends on. Four years later, it has been taken offline not by attackers but by submitters. That inversion is the part worth studying.
Asymmetry is the whole story
Every system that accepts unsolicited claims runs on a cost ratio: what it costs to make a claim versus what it costs to check one. Bug bounties worked for two decades because that ratio favored the defender. Writing a credible vulnerability report required reading unfamiliar code, forming a hypothesis, building a proof of concept, and getting it to actually fire. Triage was expensive, but generation was more expensive. The filter was upstream, built into the difficulty of the work itself.
Language models collapsed the generation side of that ratio to near zero while leaving the verification side exactly where it was. A model can read a diff, pattern-match against a CWE taxonomy, and emit a report that has the shape, vocabulary, and structural confidence of real security research. Nothing about the output signals whether a human or a sampler produced it. Triage cost did not move. Submission cost fell off a cliff.
When that ratio flips, the queue stops being a signal channel and becomes noise with a submit button. Google’s suspension is not an admission of failure. It is the correct response to a broken cost model, taken before maintainer goodwill burned out entirely.
What the failing agents are actually missing
From an architecture standpoint, the flood of invalid reports is a textbook grounding failure. Most of these pipelines are doing one thing: text in, text out. The model never executes anything. It never observes a crash, never watches a sanitizer trip, never confirms that the code path it describes is reachable from any real entry point. It produces a description of a vulnerability rather than evidence of one, and those two artifacts are indistinguishable on the page.
A properly built security agent looks different. The generative step is a hypothesis engine, not the output layer. Behind it sit components that cost something to run:
- A sandbox that builds the target at the specified commit and runs the candidate input
- A fuzzing or symbolic execution stage that tries to reach the suspect path from a genuine entry point
- A differential check confirming the patched version behaves differently from the unpatched one
- A self-rejection loop that discards hypotheses failing any of the above, with no human ever seeing them
The expensive part of a competent agent is the discarding. Models are cheap at proposing and terrible at knowing when they are wrong, so the verification scaffolding has to carry that burden. Pipelines without it export their uncertainty to whoever is on the receiving end. Open source maintainers, in this case, who were never consulted.
Rebuilding the filter
Whatever Google ships by early 2027 will have to restore the cost asymmetry, and politely asking people to self-disclose AI use will not do it. The structural options are more interesting.
Require machine-checkable artifacts as the price of entry. A report with a container image, a reproduction command, and a deterministic failure becomes checkable in seconds instead of hours. That single change moves triage cost below submission cost and makes agents useful rather than parasitic, because a well-built agent can produce exactly that artifact and a text generator cannot.
Reputation staking is the other lever. Make submitters risk something they have accumulated, so volume without accuracy becomes self-limiting. Pair it with a validated-submission gate before anyone can enter the firehose.
None of this is anti-AI. Automated bug discovery with real execution behind it is one of the most promising applications of agent systems anywhere, and it predates language models by years. The distinction that matters now is not human versus machine. It is verified versus asserted. Google’s queue drowned in assertions, and the fix is to stop accepting them.
🕒 Published: