GoKawiilGoogle halts OSS VRP submissions due to surge in invalid automated bug reports
Google has temporarily suspended accepting vulnerability reports through its OSS VRP after experiencing a significant increase in automated submissions, many of which are invalid. The company plans to revise the program in early 2027 to address the issue, citing that most recent reports are not genuine bugs. This move follows earlier warnings about a rise in AI-generated, sometimes hallucinated, vulnerability reports.
GoKawiil's interpretation of the reporting above, not reported fact.
This development highlights how advances in AI for security testing can lead to unintended consequences, such as overwhelming reporting systems with false positives. It suggests that while AI can enhance bug detection, managing its outputs remains a challenge, potentially affecting the efficiency of vulnerability programs and overall security workflows.
- AI-driven bug reports can flood vulnerability programs, creating management challenges.
- Google is revising its OSS VRP to filter out invalid submissions.
- The incident underscores the need for better AI report validation methods.
Source: androidauthority.com, 2026-10-06
Published there as: “Google praised AI for finding bugs. Now it has too many reports, not enough bugs”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.