Google adds $250,000 root-in-cloud bug bounty reward
Original title: Google Introduces $250,000 Root-in-Cloud Bug Bounty Reward
New tier rewards researchers for proving full administrative control over Google Cloud organizations without prior access.
Google expanded its Cloud Vulnerability Reward Program with a $250,000 reward for high-impact architectural exploits leading to roles/owner privileges. Rewards are for remote code execution in Borg or root-in-production. Researchers must halt probing upon achieving execution and cannot extract credentials. A deterministic proof-of-root mechanism is provided for validation.
Unconfirmed: No specific number of vulnerabilities rewarded under new tier
- $250,000 for tenant or project takeover
- No rewards for RCE in Borg without qualification
- Uses agentic systems and intuition for finding bugs
- First-time researchers using AI tools find more bugs
Impact: full administrative control over Google Cloud projects
- 1.report vulnerabilities via VRP
- 2.avoid probing Borg infrastructure
From the original article
2 min read at securityweek.com
The top payout is for high-impact architectural research demonstrating full administrative control. The post Google Introduces $250,000 Root-in-Cloud Bug Bounty Reward appeared first on SecurityWeek.
By Ionut Arghire · securityweek.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.