Google has launched a new $250,000 Google Cloud bounty tier for security researchers who uncover architectural vulnerabilities capable of granting complete administrative control over customer environments without prior access or credentials.
Key points
- Google Cloud has introduced a $250,000 top bounty for Root-in-Cloud flaws that break tenant isolation.
- Eligible exploits must demonstrate full organisation-level takeover without using social engineering or stolen credentials.
- Researchers demonstrating remote code execution on Google production systems must stop probing immediately to avoid disqualification.
- The company paid out a record $17.1 million across all vulnerability programs in 2025.
The new payout level sits inside Google’s long-running Cloud Vulnerability Reward Program. It focuses strictly on high-impact architectural flaws, including tenant-isolation bypasses and cross-service logic errors that could allow an attacker to seize full administrative control over arbitrary cloud organisations or projects.
To qualify for the maximum reward, an attack path cannot rely on pre-existing privileges, compromised service keys, or user interaction. The vulnerability must work against an arbitrary project from an unprivileged standing position.
What counts as a Root-in-Cloud flaw
The standard for the $250,000 reward is intentionally high. A researcher must show the equivalent of roles/owner permissions or complete Identity and Access Management control over an arbitrary Google Cloud target without any special initial configuration.
In a public announcement detailing the new tier, said Chris Betz, Google Cloud’s chief information security officer: “To earn this premier reward, you must demonstrate full administrative control, the equivalent of ‘roles/owner’ or complete IAM control, over arbitrary Google Cloud organizations or projects with no prior access or special project setup.”
The scope also extends downward into the core systems that run Google services. If a researcher uncovers valid remote code execution vulnerabilities in Borg, Google’s internal cluster management platform, or achieves root privileges in production systems, the report qualifies automatically for evaluation under the root-tier prize table.
Such deep architectural flaws represent the most severe threat model for enterprise cloud providers. While basic misconfigurations often lead to credential leakage, structural vulnerabilities that allow an attacker to jump between enterprise tenants threaten the core isolation model that underpins public cloud computing.
Strict boundaries for production probing
Testing live enterprise infrastructure carries serious operational risks for customers. Because of this, Google has set firm boundaries on how researchers validate their findings.
Security specialists who gain execution on Google’s internal production infrastructure are explicitly forbidden from expanding their foothold. Attempting lateral movement, seeking production credentials, or exploring adjacent clusters results in immediate disqualification from the reward program.
Michael Cote, Google Cloud VRP lead, stressed that customer safety dictated the design of the rules: “High incentives require clear, safe rules of engagement. We never want researchers testing exploits against real customer projects.”
To solve the verification challenge without risking live customer data, Google built an isolated testing harness. Researchers must prove their exploit against a designated service account, providing cryptographic proof of unauthorised privilege acquisition rather than targeting third-party deployments.
Full technical criteria, including exact API endpoints, command-line interface examples, and required JSON validation payloads, are published on Google’s official rules page.
Rising stakes in cloud infrastructure
Major cloud providers face intense scrutiny over isolation integrity as public sector bodies and global enterprises move mission-critical workloads to shared infrastructure. The issue has become central as suppliers pursue sensitive government work, visible in recent Google Golden Dome talks over defence data security.
At the same time, criminals increasingly target enterprise infrastructure for automated abuse. Earlier research revealed how automated LLMjacking attacks cost victims $100,000 a day when credentials leak, driving cloud firms to ensure that the core hypervisor and identity layers remain completely unbreachable.
Offering substantial cash rewards gives external security firms and independent bug hunters a clear financial alternative to private exploit brokers, who often pay six-figure sums for reliable zero-day exploits targeting enterprise hypervisors and identity systems.
Bounty inflation and research quality
Google has steadily increased its payouts since launching its first web application vulnerability scheme in 2010. In total, the company has disbursed over $81.6 million to external researchers.
Annual spending on security research has accelerated rapidly. In 2025, Google paid $17.1 million across its reward programs to more than 700 researchers. That represented a 40 percent jump from 2024, when payouts totalled $12 million.
However, running open bounty programs has also created administrative strain. In October, Google temporarily suspended external submissions to its Open Source Software Vulnerability Rewards Program after a surge of low-quality, AI-generated reports overwhelmed human review panels.
By establishing rigorous, verifiable cryptographic criteria for its $250,000 Cloud tier, Google aims to filter out superficial automated submissions and focus capital on skilled researchers probing core system architecture.
The $250,000 Root-in-Cloud payout tier is active immediately for all eligible researchers submitting through Google’s bug hunter portal.
