Google announced that starting October 1, 2026, the Open Source Software Vulnerability Reward
Program (OSS VRP) will no longer accept product vulnerability submissions, while previously submitted vulnerabilities remain unaffected. According to Tom's Hardware, insiders said that thousands of reports claiming severe vulnerabilities turned out to be AI hallucinations and were not practically exploitable, occupying time that could have been used to fix real high-risk bugs. Vulnerabilities in Google Cloud-related repositories can still be submitted via Cloud VRP. Google plans to announce OSS VRP restructuring progress in the first quarter of 2027.
IT之家：https://www.ithome.com/ 10 月 4 日消息，谷歌宣布，自 2026 年 10 月 1 日起，开源软件漏洞奖励计划（OSS VRP）将不再接收产品漏洞提报。本次规则调整不影响 2026 年 10 月 1 日之前已提交的产品漏洞。
不过，针对部分可能对谷歌云（Google Cloud）产品造成影响的谷歌云代码仓库，如果涉及产品漏洞，谷歌仍可能通过云漏洞奖励计划（Cloud VRP）接收相关报告。
OSS VRP 是谷歌设立的一项专业安全赏金计划，旨在通过激励独立安全研究人员，在谷歌整个开源生态系统中挖掘并负责任地披露安全缺陷。
据 Tom's Hardware 报道，知情人士透露， 谷歌工程师与开源代码维护人员已被数以千计的劣质报告彻底吞没 。这些报告声称发现了严重漏洞，但深入排查后发现，它们全都是 AI 产生的“幻觉”，根本无效且无法被实际利用。
维护团队不得不将大量精力耗费在验证这些虚假代码上，严重挤占了修复现实中高危漏洞的时间。这正是导致谷歌最终叫停该计划的直接原因。
IT之家获悉，谷歌官方表示，将持续对 OSS VRP 的相关机制进行重组与优化，并计划于 2027 年第一季度公布最新进展。
The readable text on this page was extracted from the public source and organized with attribution, publication time and the original link. Copyright remains with the original author and publisher.
Scan to open this article