Google Introduces $250,000 Root-in-Cloud Bug Bounty Reward

Google has expanded its Cloud Vulnerability Reward Program (VRP) with a new $250,000 top-tier reward for security weaknesses that could lead to full administrative control.

The premier payout is “specifically designed to recognize high-impact architectural research” and will be handed out to researchers who can demonstrate gaining ‘roles/owner’ privileges or complete IAM control over arbitrary Google Cloud organizations or projects.

According to the internet giant, to qualify for the reward, the exploit path should not depend on pre-existing access to a project, previously compromised credentials, or user interaction/social engineering.

Reports that demonstrate remote code execution (RCE) in Borg (Google’s underlying production infrastructure) or root-in-production will also be evaluated for the new $250,000 root-in-cloud reward .

“Because code execution in Borg has the potential to impact service availability or cross-tenant data, researchers must halt all probing immediately upon achieving any execution in Borg. Escalation, extracting production credentials, and lateral movement are not allowed and will result in researcher disqualification,” Google Cloud CISO Chris Betz said.

The company has added the root-in-cloud validation criteria to its Cloud VRP page, explaining that it will award the bug bounty if its analysis of the initial entry point, execution context, and attack surface demonstrates that full arbitrary tenant or project takeover is possible.

“Identifying tenant-isolation bypasses and complex cross-service logic flaws requires human creativity, intuition, and rigorous systems analysis combined with the power of agentic systems,” Betz noted.

According to Michael Cote, Google Cloud’s vulnerability reward program lead, first-time researchers who combine their own intuition with agentic tools are finding more interesting bugs, on average, than novices did two years ago.

He also pointed out that finding bugs eligible for the new root-in-cloud tier requires deep architectural intuition and AI.

“High incentives require clear, safe rules of engagement. We never want researchers testing exploits against real customer projects. Instead, we created a deterministic proof-of-root mechanism using a designated service account. Researchers can cryptographically prove unauthorized access against that identity,” Cote said.

Related: Google Partially Reverses Chrome Bug Bounty Cuts

Related: Google Narrows Open Source Bug Bounty Amid Wave of Invalid Automated Reports

Related: Microsoft Bug Bounty Program: $20 Million Paid to 500 Researchers

Related: Will AI Kill the Bug Bounty Industry?

Google Partially Reverses Chrome Bug Bounty Cuts

Google is restructuring bug bounty rewards with a focus on complex memory safety vulnerabilities.

Artificial Intelligence

Google Narrows Open Source Bug Bounty Amid Wave of Invalid Automated Reports

Google has temporarily stopped accepting product vulnerability reports through its Open Source Software Vulnerability Reward Program (OSS VRP).

Google Cloud Sets Out Post-Quantum Roadmap With 2029 Readiness Goal

Google Cloud outlines its roadmap to full post-quantum cryptography readiness, with key milestones targeted for 2027 and 2028.

Microsoft Bug Bounty Program: $20 Million Paid to 500 Researchers

The biggest single reward paid out by Microsoft between July 1, 2025, and June 30, 2026, was $200,000.

Artificial Intelligence

Google Dialogflow CX Bug Allowed Attackers to Hijack AI Conversations

The "Rogue Agent" vulnerability could have enabled attackers to silently manipulate AI conversations, exfiltrate data, and compromise every Dialogflow CX agent within the same...

Artificial Intelligence

Amazon Q Flaw Enabled Cloud Credential Theft via Malicious Repositories

AWS has patched the vulnerability and published its own advisory to inform customers the potential impact.

Artificial Intelligence

Will AI Kill the Bug Bounty Industry?

Anthropic's Mythos is accelerating vulnerability discovery to machine speed, forcing the bug bounty industry and offensive security teams to adapt to a future where...

Microsoft Paid Out $2.3 Million at Zero Day Quest 2026 Hacking Contest

Researchers found more than 80 high-impact cloud and AI vulnerabilities during the event, which had a $5 million prize pool.