Google praised AI for finding bugs. Now it has too many reports, not enough bugs

TL;DR Google has stopped accepting product vulnerability reports through its OSS VRP after a sharp rise in automated submissions, many of which it says are invalid. The company had already warned in March about a massive surge in AI-generated reports, including hallucinated bugs and low-impact issues. The timing is hard to ignore: Google has spent much of 2026 praising AI for making bug hunting faster, easier, and far more productive.