Blaming a “significant rise” in AI submissions, Google has paused its open source bug bounty program until next year.

Last year, TechCrunch reported that cybersecurity experts were warning of that AI slop posed a serious risk to bug bounty programs. Looks like that’s the issue confronting Google’s Open Source Software Vulnerability Rewards Program, where researchers were rewarded for finding vulnerabilities in the company’s open source software.

In posts on X and the program website, Google said the bug bounty program was paused as of October 1, with a promise to provide “an update” in the first quarter of 2027. According to Tom’s Hardware, Google engineers and open source maintainers were overwhelmed by reports that were invalid or contained hallucinations.

“This pause is due to a significant rise in automated submissions, the vast majority of which are not valid,” the company said.

In the meantime, participants are encouraged to consider Google’s other bug bounty programs.

Google OSS VRP: History and Scope

Google’s Open Source Vulnerability Rewards Program (OSS VRP) was launched in August 2022. It rewards security researchers for identifying vulnerabilities in Google’s open-source software projects.

The program covers the latest versions of open-source software hosted in public repositories owned by Google on GitHub, as well as selected repositories on other platforms.

It also includes repository configuration settings, such as GitHub Actions workflows, access control rules and GitHub application configurations.

Rewards range from $100 to $31,337 based on the severity level of the reported flaws and the project’s importance.

The OSS VRP is one of several bug bounty programs operated by Google and has a relatively narrow focus.

Vulnerabilities in Google’s open source projects that are closely linked to Google Cloud or AI products are directed to the Google Cloud Vulnerability Reward Program (Cloud VRP) or the AI Vulnerability Reward Program (AI VRP), allowing reports to be routed to the teams best placed to assess and address them.

Google Plans OSS VRP Overhaul

The suspension will not affect OSS VRP supply-chain reports or any reports already submitted, Google said.

The company plans to “reformat” the program and expects to provide an update in the first quarter of 2027.

“As an alternative, we encourage you to find impact across our other VRP programs and submit there instead, or pursue the Patch Rewards Program,” Google said.

Bottom line: Steam is on course to generate more than $20 billion in gross revenue in 2026, a first for the platform, after posting record results for September and the third quarter, according to estimates from Alinea Analytics. The gains came from a mix of new releases, established franchises and free-to-play games that keep drawing spending long after launch. With one quarter left, Valve’s PC gaming platform needs roughly $3.5 billion to reach the milestone.

Steam took in an estimated $1.7 billion in September, 13% more than the previous September record, set in 2025. Its estimated third-quarter revenue reached $5.5 billion, up 12% from the same period last year.

The September result came from a familiar mix: big paid releases, durable franchises and free-to-play titles built around in-game purchases. The numbers suggest Steam no longer depends on a single kind of game sale to drive revenue.

New releases can produce a sharp burst of revenue, while games such as Counter-Strike 2 and Dota 2 keep earning money through active player communities and digital-item sales.

Through the first nine months of 2026, Steam generated an estimated $16.5 billion, compared with $14.5 billion over the same stretch of 2025. At that pace, the platform needs about $3.5 billion in the final quarter to clear $20 billion for the year.

New games played a meaningful role in September. Among Steam’s 500 top-grossing titles that month, games released in 2026 accounted for about 33.6% of revenue, according to Alinea, and new intellectual property made up 20.5% of that.

That doesn’t mean newer games displaced the industry’s biggest brands. Established franchises, which include remakes and remasters, accounted for almost 80% of revenue among the top 500. The two figures overlap because they slice the data differently, by release year and by franchise, so a 2026 sequel counts in both. Steam’s strongest performers still tend to be games with recognizable names, built-in audiences and frequent content updates.

Free-to-play games remained a major source of revenue as well. Counter-Strike 2, Apex Legends, PUBG and Dota 2 together generated almost $168 million in September, per Alinea’s estimates, or nearly 10% of Steam’s estimated monthly revenue.

Those games show why PC platforms can’t be judged by unit sales alone. Free-to-play titles may cost nothing to download, but they can drive steady spending on cosmetic items, battle passes and other digital content. For Steam, those transactions turn a large player base into recurring revenue.

Paid games accounted for several of the month’s biggest individual performances. PvP shooter Wardogs brought in an estimated $86.9 million in the roughly three weeks after it entered Early Access on September 10. Onimusha: Way of the Sword generated $30.4 million during the month, and The Blood of Dawnwalker added $26.9 million.

EA Sports FC 27 contributed another $20.7 million from Steam copies, though most of its sales were on consoles.

Wardogs’ Early Access performance is notable because it shows how large a role the model now plays on Steam. Developers can release a game before it’s finished, collect revenue early and use player feedback to shape updates. For multiplayer games, that can also help build a community before a full launch.

• Oregon’s data center tax breaks have become a major political flashpoint statewide
• A warning about one election cycle helped accelerate Oregon’s grassroots organizing
• More than $450 million in exemptions intensified scrutiny of Oregon data centers

Oregon’s expanding data center industry has triggered an increasingly organized political backlash involving residents, environmental groups, educators, farmers and elected officials.

The dispute intensified after reports showed Oregon data centers receiving more than $450 million in property tax exemptions during 2026, including about $85 million in the Hillsboro area.

In this week’s Sunday Reboot, the expansion of Apple Pay and Apple Music to some countries has taken a decade longer than they really should. They also demonstrate how delays can happen for many different reasons.

Sunday Reboot is a weekly column covering some of the lighter stories within the Apple reality distortion field from the past seven days. All to get next week underway with a good first step.

Apple Music adds to its territory list

It may be a surprise to some readers, but I’m not in the United States. I’m one of the few members of the editorial team based in the United Kingdom, but trained to write in the American way, and forget about the letter U in some words.

This does lead to some issues when it comes to trying out Apple’s new services. It’s a problem when your whole job is to talk about them.

Thankfully, the UK does have access to almost all of Apple’s services, but there are blind spots and differences.

For example, while I have access to Apple Pay, I cannot use services like Apple Card because they are US-only for the moment. Except that I have to change region sometimes for reporting, and now I annoyingly have an Apple Cash card permanently visible in the Wallet app that I cannot use at all.

A little less pressing is the lack of puzzles in News+ over here. Though I can understand the financial problems in setting up Apple Card in the UK, it seems there would be fewer obstacles in adding brainteasers to Apple News, just as U.S. users enjoy.

That said, I am still quite glad to be in the UK where Apple products and services come into play. Partly because we don’t suffer from the EU blackout of some upcoming features.

We at least get the updates fairly quickly. Unlike some service updates that happened this week.

Apple Music has expanded into four new countries, including Albania.

On Wednesday, an update to Apple Music finally rolled it out into four countries: Albania, Brunei, Burkina Faso, and Pakistan.

This sounds fairly OK, until you remember that Apple Music was unveiled in June 2015 in over 100 countries. It’s taken over 11 years for Apple Music to be available in those four countries.

There’s no real explanation for the lack of support in those countries, nor why it took so long.

The more time-consuming problems would revolve around licensing negotiations. However, both Apple and record labels like money, and so you’d expect negotiations to happen at a fairly quick pace.

Then again, it could easily be because Apple has bigger problems at hand than adding support to some countries it’s seemingly forgotten about for over a decade.

Regardless, it’s a good thing that Apple Music is now available in four more territories that endured a very long wait.

It also reminds me that I’m lucky to live where I do. While there are always going to be differences between US and UK availability for things, I’m not realistically going to be waiting for a decade for anything.

Wait, Apple Pay wasn’t in India already?

Slightly less puzzling is the Apple Pay update on the same day. After launching in 2014, Apple finally brought Apple Pay live in India.

It certainly makes sense for Apple to do so, because it is a massive market, and an emerging one at that.

The problem here is that Apple said back in 2017 that it was trying to bring Apple Pay to India. That’s a nine-year wait.

As for why it took so long, we could certainly blame regulations for that. In June 2022, more financial laws were introduced, which got in the way.

While in the rest of the world you could use Face ID for a transaction, India instead wanted everyone to use its Aadhaar ID system instead. The laws also covered subscriptions, requiring banks to notify users 24 hours in advance of any recurring transactions, and allowing them to cancel.

Apple Pay is finally available in India.

There’s also the matter of a card tokenization framework, which required the use of encrypted tokens issued by local banks in India. This would’ve required Apple to make changes to how Apple Pay’s security and authentication ultimately functioned.

Support for the country’s Unified Payments Interface also caused problems.

It was so bad that, in 2022, Apple gave up on credit and debit cards completely in the country.

During this time, both Google Play and Samsung Wallet opted to comply with the law instead of ceasing card payments. It was clearly a case of Apple seeing a massive amount of work and rules that it would have to comply with, and the belief that it could work around or negotiate the hurdles away.

After negotiating with banks to get around the problematic elements, Apple eventually tested card payments in India in July 2026, months before Apple Pay’s rollout.

The final introduction of Apple Pay in India is certainly a good thing for Apple, especially in such an important market.

It will be interesting to see how much change Apple Pay will make to iPhone sales in India. It’s main rivals have a very large head start because of Apple’s unwillingness to abide by the new laws, so it has a lot of catching up to do.

Finally, eventually

Apple’s decision to expand the reach of two of its services at the same time demonstrates that there can be a variety of reasons for a delay of a service rolling out in a country.

For Apple Pay in India, as well as the various features EU users cannot access, it’s a regulatory problem. When you have to deal with legal issues affecting over a hundred countries simultaneously, you have to prioritize and pick your battles.

Even if it’s something that can take years to fully resolve.

For others, like bringing Apple Music to Albania, it seems to be less about legal issues and sticking to the letter of the law. It could just as easily be Apple making it a very low priority for it to work on because there’s not enough value to work harder at it.

With Apple Pay in India, there’s enough of a carrot for Apple to work to fix it. Even if it does take close to a decade to resolve.

Last week’s Sunday Reboot discussed Apple’s fitness changes, Apple Watch nagging, and how the Whoop-like device could be a very beneficial wearable.

The camera housing on my Meta Nova glasses is smaller than on the Gen 2 glasses. From a distance, they might even read as rivets at a glance. (I asked my colleague Reece Rogers how they looked on my face, and from a few feet away in the WIRED office, he didn’t even notice they were camera-enabled glasses at first.)

They feel and function the same as before. You can interact with an AI assistant or snap photos and video with the press of a button. Conversation Focus, a mode that helps hard-of-hearing people better pick up spoken words, is a feature that only works in early access on Meta’s Ray-Ban and Oakley smart glasses. It seems very helpful, but my Meta-designed frames don’t have it yet.

They also don’t have integration with Meta’s Muse AI, which the company says is coming later this year. I’m intrigued by that, even if having access to a camera on your face will certainly help a service that seems better at surveilling than helping its users. That said, I’ve found Muse more useful than Meta’s current AI assistant, and I look forward to asking my entirely too cute AI buddy to assist me via my glasses.

Unfortunately, Meta’s current AI assistant on the glasses is still terrible. I tried to ask what features the glasses I was wearing had, and it failed miserably. The AI couldn’t get any of the details right, even when I told it specifically which frames I was wearing and let it snap a picture of the Meta product page for reference. I wouldn’t want to depend on the AI to help me sort out anything with some real complexity.

If you pretty much ignore the AI entirely, the Gen 3 glasses do just about everything Meta promises. They capture nice photos and video, all while maintaining an indicator light that has recently been made more tamper-proof. (That’s not necessarily enough to deter the creeps.) The frames are wearable, and the software is competent enough. They’re also pricey, so maybe you can save some cash sticking with the Gen 2. They’ll all do what you probably expect them to do. Just maybe don’t be weird about it, all right?

For only £192.12, you can now get Sony’s WH-1000XM5 with active noise cancellation and a matching hard case.

Add Hi-Res Audio support and a 30-hour battery to that list, and the Sony WH-1000XM5 at £192.12 starts to look like a complete travel companion, ready for early commutes, long flights and late-night listening at home.