Google Introduces $250,000 Reward for Critical Cloud Infrastructure Vulnerabilities

Google has expanded its Cloud Vulnerability Reward Program (VRP) by introducing a new $250,000 top-tier payout for security researchers who identify high-impact architectural weaknesses.

The premier reward is specifically aimed at researchers who can demonstrate full administrative control over Google Cloud environments. This includes gaining ‘roles/owner’ privileges or achieving complete Identity and Access Management (IAM) control over arbitrary Google Cloud organisations or projects.

Strict Rules for Borg and Production Infrastructure

The new tier also evaluates reports involving remote code execution (RCE) within Borg, Google’s underlying production infrastructure. However, Google has established rigorous rules of engagement to protect its live environment.

Google Cloud Chief Information Security Officer (CISO) Chris Betz stated that researchers must halt all probing immediately upon achieving any level of execution within Borg. Actions such as escalation, extracting production credentials, or lateral movement are strictly prohibited and will result in the researcher’s disqualification from the programme.

To qualify for the reward, the exploit path must be independent of pre-existing access, previously compromised credentials, or social engineering tactics.

Safe Verification and the Role of AI

To prevent researchers from testing exploits against actual customer projects, Google Cloud has implemented a deterministic proof-of-root mechanism. Michael Cote, the company’s vulnerability reward program lead, explained that researchers can use a designated service account to cryptographically prove unauthorised access.

Cote noted that finding bugs eligible for this tier requires deep architectural intuition. He also highlighted that modern researchers are increasingly using agentic AI tools alongside human creativity to identify complex cross-service logic flaws and tenant-isolation bypasses.