Google Cloud adds a $250,000 top reward for cloud takeover bugs

Google Cloud introduced a new $250,000 'Root-in-Cloud' reward tier in its Vulnerability Reward Program, aimed at high-impact architectural research such as tenant-isolation bypasses and complex cross-service logic flaws. To qualify, researchers must demonstrate full administrative control over an arbitrary Google Cloud organization or project with no prior access or special project setup, and the exploit path can't rely on pre-existing footholds, leaked or stolen credentials, or social engineering.

Google says it built a deterministic 'proof-of-root' mechanism using a designated service account so researchers can cryptographically prove unauthorized access without testing against real customer environments. Reports that show remote code execution in Google's underlying production infrastructure (Borg) will automatically be evaluated for Root-in-Cloud eligibility, though researchers must stop probing immediately once they achieve execution there.

In an accompanying Q&A, Google Cloud VRP lead Michael Cote said the volume of vulnerability reports has grown sharply as agentic tools lower the barrier to finding bugs, even though the number of valid reports has stayed roughly stable over the past 18 months. He also pointed to Google Threat Intelligence Group research showing monthly CVE disclosures have doubled as these tools mature, and warned that competitive pressure to publish quickly, rather than follow coordinated disclosure timelines, is a growing risk.

Why it matters

A quarter-million-dollar bounty signals how seriously cloud providers are taking tenant-isolation and architecture-level bugs as AI tools make vulnerability hunting faster and more crowded.

Source: Google Cloud