Google has suspended its Open Source Software Vulnerability Rewards Program (OSS VRP), a vulnerability search initiative that paid researchers for finding flaws in the company's open-source software. The pause took effect on October 1, 2026. Google blamed a "significant rise" in automated and AI-generated reports, most of which turned out to be invalid.Google announced the suspension in posts on X and on the program's website. It said it would provide "an update" in the first quarter of 2027. According to Tom's Hardware, Google engineers and open-source maintainers had been overwhelmed by reports that were invalid or contained hallucinations.
Why Google Halted OSS VRP
"This pause is due to a significant rise in automated submissions, the vast majority of which are not valid," the company said.In the meantime, Google is encouraging participants to look at its other bug bounty programs.As of October 1, 2026, the OSS VRP no longer accepts product vulnerability reports. Some reports involving Google Cloud repositories that affect Cloud products may still be accepted through the Cloud VRP. Flaws in open-source projects closely tied to Cloud or AI products can go to the Cloud VRP or the AI VRP. Researchers can also turn to the Patch Rewards Program, which pays for security improvements to Google's open-source projects. Reports submitted before October 1 are not affected.Product vulnerabilities previously covered flaws that substantially affected the confidentiality or integrity of user data. Examples included memory corruption in file format parsers or network protocols, sanitizer failures, path traversal, and insecure defaults or code examples in documentation. For OT0 and OT1 repositories, memory corruption reports required exact OSS-Fuzz reproduction steps or an already merged patch. Non-memory corruption reports did not need a patch. Google also urged researchers to build OSS-Fuzz integrations for important projects that lacked them before reporting.
How Project Tiers Shape Vulnerability Search Rewards
Repositories fall into four tiers:
Flagship (OT0) projects are the most sensitive and carry the highest payouts.
Important (OT1) projects have significant community impact or security criticality. Both OT0 and OT1 are listed at github.com/google/bughunters.
Standard (OT2) covers active repositories with stable packages on registries such as npm or PyPI. There is no published list for this tier.
Low-priority (OT3) includes experimental, sample, research, and archived projects. These earn no financial rewards.
Supply chain compromises pay $3,133.7 to $31,337 for OT0, $1,337 to $13,337 for OT1, and $500 to $3,133.7 for OT2. Other security issues, such as leaked write-access credentials or weak passwords on third-party CI systems, earn $1,000 for OT0 and $500 for OT1. OT2 and OT3 projects receive nothing for product vulnerabilities or other security issues.A reward panel sets final amounts based on security impact alone. It may pay more for clever or wide-reaching bugs and less for those that depend on hypothetical flaws. It typically pays once per root cause, though bonuses of about $1,000 are possible for especially clever findings or well-written reports. Researchers can donate their rewards to charity. Rewards left unclaimed after 12 months go to a charity of Google's choosing.Several categories are excluded:
Issues rooted in downstream integration
Typosquatting without proof that build artifacts were compromised
Google also asks researchers to avoid DoS attacks, black hat SEO, spam, and high-traffic automated testing tools. Reports go through Google's vulnerability form and should include a buildable proof of concept, the affected versions, an impact description, and an attack scenario.
In late 1970, a Titan IIIC rocket launched from Space Launch Complex 40 at what was then called Cape Canaveral Air Force Station. It carried a top-secret payload for the US military.
Much has changed in spaceflight since then. The Titan IIIC would bow out in 1982 after dozens of launches. Various Titans continued launching from Space Launch Complex 40 until 2005, at which point the US Air Force—in a competitive process hotly opposed by United Launch Alliance—turned the pad over to a small, largely unknown startup called SpaceX. And Cape Canaveral is now a "Space Force" station.
But those unspecified payloads? Until last month, some of them were still flying operationally.
Bill Draper began funding start-ups in the early 1960s, when the Santa Clara Valley was better known for apricot orchards than microchips. He has died at 98.
Young people use AI for everything. From schoolwork to interview prep, relationship advice to shopping decisions, the technology has become part of how young people live. For the most digitally fluent generation ever, AI is a competitive edge, a creative partner, and an always-on assistant.
But the same technology making young people’s lives easier is also making the internet harder to navigate. AI is making scams more convincing, identities easier to manipulate, and online content harder to trust. Seven in ten (70%) 18-to-22-year-olds have experienced an AI-related scam in the last year, compared to half of the general population. And nearly every young person worries AI will be used against them.
This isn’t happening because young people are reckless. It’s happening because the online platforms they rely on for everyday life now double as entry points for AI threats: social feeds where manipulated content and real content sit side by side, online marketplaces filled with fake storefronts and reviews, messaging channels where threats can be personalized, and AI tools that can make false information feel like the truth.
That creates a new kind of safety burden. Young people are being asked to use AI, judge its output, protect their identities, and avoid increasingly personalized scams all at once. The result is a digital life that feels more powerful, but also more vulnerable to abuse.
The internet is getting harder for young people to trust
The internet young people grew up with isn’t the same one they’re facing today. AI has changed the landscape, making it harder for even these digital natives to know what information is credible and safe. Half of 18-to-22-year-olds strongly agree that it’s becoming harder to tell what content is genuinely human or real.
Young people have had a front row seat to how AI can bend the truth. Nearly half have seen AI provide information they knew or later found out was wrong or misleading (44% versus 30% of the general population). Nearly one in four (23%) have suffered negative consequences because of AI advice, compared with 16% of the general population, and 18% say they have suffered emotionally from AI advice, compared with 12% of the general population. For a generation using AI in every corner of their lives, bad information can have lasting effects on their credibility, reputation, and relationships.
Many young people have changed how they engage online as a result:
47% of young people say AI has changed how much they trust reviews or content, compared with 37% of the general population
35% say AI has changed how they shop online, compared with 26%
32% say AI has changed how they present themselves professionally, compared with 20%
19% say AI has changed how they date or communicate romantically, compared with 10%
As one young person said about online dating:
“Dating isn’t an option for me online anymore. You just never know what is or isn’t AI, and I don’t want to spend a lot of time on someone fake.”
AI is making it easier for scams to reach young people
The harder it becomes to tell what is real, the easier it becomes for scams to work. For young people, AI is fueling a wave of scams that are more personal and invasive than ever before.
Nearly one in four young people have been a victim of an extortion scam of some kind (24% versus 17% of the general population).
Nearly one in five have been a victim of a deepfake or virtual kidnapping scam (19% versus 8%).
Nearly one in ten have been a victim of sextortion (8% versus 7%).
More than one in ten have been a victim of an impersonation scam (14% versus 10%).
More than one in ten have been a victim of a romance scam (12% versus 10%).
What’s striking isn’t just how many young people have been victimized—it’s how many have been targeted:
More than half have been the target of an extortion scam (56% versus 42% of the general population).
47% have encountered an impersonation scam (versus 35%)
46% have encountered a romance scam (versus 33%).
More than four in ten have been targeted by a deepfake or virtual kidnapping scam (43% versus 26%).
Nearly four in ten have encountered sextortion (38% versus 24%).
These scams may look different on the surface, but they all work the same way: they exploit fear, trust, shame, and intimacy. The more often young people encounter them, the more chances scammers have to find exactly which emotional triggers work.
This exposure isn’t random. Young people are on social platforms at rates up to three times those of the general population: 89% use Instagram (versus 55% of the general population), 78% use TikTok (versus 38%), 68% use Snapchat (versus 26%), and 49% use Pinterest (versus 25%). Scammers can use these platforms to get everything they need to make their threats more convincing: public photos, friend networks, school affiliations, relationship clues, and everyday posts containing personal information. With AI, scammers can use that content to create explicit images, clone voices, impersonate profiles, and create threats personalized with details that are hard to ignore.
One young person shared their experience:
“I had someone make fake nudes of me using AI on my photos from my social media and threaten to post them on Facebook after I realized that they had scammed me. I decided to be more careful with my personal information.”
Young people fear AI will steal what money cannot replace: identity, reputation, and sense of self
AI-fueled scams aren’t just scams in the traditional sense. They are forms of identity abuse. This is different from traditional identity theft. For young people, the risk isn’t only that someone steals a password or money. It’s that scammers can use AI to make them appear to say, do, or share something they never did, with consequences that can follow them in their personal and professional lives.
That’s why young people are so concerned about AI being used against them. The fears that hit hardest:
88% worry about AI being used to harm their professional or personal reputation versus 77% of the general population
82% worry about someone creating a fake profile pretending to be them versus 76%
81% worry about someone creating fake nude or sexually explicit photos or videos of them versus 62%; 15% say it’s happened to them already (versus 10%)
80% worry about being deceived by someone using AI to fake their identity in an online relationship versus 67%
These threats are especially powerful at a life stage where young people are still building their personal and professional reputations. A fake profile, manipulated image, or AI-generated explicit video can affect how everyone from classmates and professors to potential employers and romantic partners see them for years to come.
Young people are pulling back online, but protection is still too manual
Many young people are responding by retreating. 80% are sharing or posting less online than they were a year ago, versus 61% of the general population. Compared to the general population, more 18–22-year-olds have also taken AI-related protective measures like tightening privacy settings, removing unknown followers, using reverse image search to verify content, requesting data removal, and watermarking their own photos and videos.
Those actions matter, but they also show how much responsibility has been pushed onto individuals. Staying safer online now means constantly reviewing settings, checking sources, questioning content, and so much more. That’s a lot to ask of anyone, and the fatigue is showing: 42% of young people say they receive so many warnings they have stopped paying attention, compared with 36% of the general population. It’s hard to sustain vigilance when new risks are always emerging.
At the same time, completely opting out isn’t realistic. Young people remain deeply embedded in digital life, and they’re still some of AI’s most enthusiastic adopters: 74% say AI has had a positive impact on their lives, compared with 57% of the general population. They aren’t rejecting AI or the internet, but they are carrying more of the safety burden than they should have to.
What young people can do to help decrease their risk right now
Know the scams targeting you. Extortion, sextortion, deepfakes, and romance scams disproportionately target young people. If someone contacts you with threats of any kind, do not pay. Report it to the platform and to authorities.
Button up your social media. Everything you post publicly is available to anyone, including scammers. Tighten privacy settings on the platforms you use most and review your followers regularly.
Don’t trust product images alone. Before buying from an unfamiliar retailer, use reverse image search on product photos and look for independent reviews off the retailer’s own site.
Create a family code word. Make sure you agree on this word in person, not online. If you receive a panicked call from someone you know asking for money or information, verify they are who they say they are with the code word.
Don’t reuse passwords. If one password gets stolen in a data breach, it will likely get tried on all other accounts you might have. Use a different password for every account to keep your accounts locked down.
Turn on two-factor authentication on all your important accounts. Only 30% of young people have done this. It is one of the highest-impact protections available and takes under five minutes to set up.
Protect your devices. Use security software on all your devices, and keep all your software up to date to make sure you’re patched against all known security holes.
Malwarebytes Student Protection Program
If you’re a student or work at a university, Malwarebytes Student Protection Program provides two years of free Premium Security for three devices for all US college or university students, staff and faculty.
This includes Malwarebytes device protection for laptops, tablets, and mobile phones with built-in scam protection. It protects against creepy trackers and ads, and blocks malware, ransomware, and cybercriminals themselves.
The research in this article is based on a March 2026 survey about AI, identity, and the collapse of digital trust and was conducted among 1,500 respondents in the United States, United Kingdom, Germany, Austria, and Switzerland. This article focuses on student-aged adults, defined as respondents ages 18 to 22, compared with the general population.
Additional context comes from Malwarebytes’ 2025 research Tap, Swipe, Scam: How Everyday Mobile Habits Carry Real Risk, which looked at mobile scams and scam-related behaviors across the same markets. Both research studies were prepared by an independent research consultant and distributed via Forsta.
The IIT Kanpur Website Hack has taken an unexpected turn after the institute decided to assess the technical skills of a student who allegedly breached parts of the IIT Kanpur and IIT Madras websites following his rejection from the newly launched undergraduate cybersecurity program. Instead of immediately pursuing legal action, IIT Kanpur said it would conduct a formal technical evaluation, though admission for the current academic session remains closed.
The incident of IIT Kanpur website hack came to light after the student shared posts on X and Reddit, claiming he had breached sections of the IIT Kanpur and IIT Madras websites after being rejected from the newly launched undergraduate cybersecurity program.
Along with screenshots of the alleged breach, he stated that his objective was not to damage the institutions but to prove his capabilities.The student also left a message on the IIT Kanpur website that read, "Site is hacked. All I need is just a fair chance." In his social media posts, he said he had completed the admission process by paying the required fees, submitting application forms and documents, and providing evidence of his work in cybersecurity. However, he claimed he was not shortlisted for the hackathon, a key stage in the admission process for the IIT Kanpur cybersecurity program.
IIT Kanpur Offers Technical Assessment Instead of Legal Action
Speaking to PTI, IIT Kanpur Director Manindra Agrawal confirmed that the student had gained access to certain portions of the IIT Kanpur website. He explained that the applicant was not shortlisted because he lacked prior cybersecurity experience."The admission process for this academic session has already concluded, so admission is not possible now. However, we will invite the student to the institute, assess his technical skills through a proper test and, if he proves his competence, give him an opportunity in the next admission cycle," Agrawal said.Agrawal also confirmed that the student had accessed parts of both the IIT Kanpur and IIT Madras websites. He added that senior faculty members and engineers would meet the student to explain that unauthorized access to computer systems is illegal and should not be repeated.
IIT Kanpur Had Initially Considered Filing an FIR
According to another institute official, IIT Kanpur initially considered filing a First Information Report (FIR) over the breach. However, before taking any legal action, the institute decided to verify the student's claims and independently assess his technical abilities.The official, who spoke on the condition of anonymity, said IIT Kanpur has previously recognised young cybersecurity talent. Earlier this year, the institute offered a position at its C3iHub to a youth who identified vulnerabilities in the CBSE online screen-marking portal.While the student's actions have raised legal and ethical concerns for both IIT Kanpur and IIT Madras, the authorities have opted to focus on evaluating his skills through a structured assessment rather than immediately pursuing criminal proceedings. Although he cannot join the current cybersecurity program, a successful technical evaluation could allow him to be considered during the next admission cycle.
Login
