Google offers $250,000 for cloud takeover vulnerabilities

Google has expanded its Cloud Vulnerability Reward Program (VRP) with a new top-tier reward of $250,000 for security weaknesses that could grant full administrative control over Google Cloud organisations or projects. The prize is described as recognising high-impact architectural research and is targeted at researchers who can demonstrate obtaining roles/owner privileges or complete IAM control without relying on pre-existing project access, compromised credentials, or user interaction.

Google notes that reports showing remote code execution (RCE) in Borg, its production infrastructure, or root access in production will be evaluated for the root-in-cloud reward. CISO Chris Betz emphasised that, because code execution in Borg could affect service availability or cross-tenant data, researchers must halt all probing once any execution is achieved; escalation, extraction of production credentials, and lateral movement are disallowed and may result in disqualification.

The VRP now includes root-in-cloud validation criteria, which require demonstration through analysis of the initial entry point, execution context, and attack surface that full takeover of a tenant or project is possible.

Google Cloud’s vulnerability reward programme lead, Michael Cote, said that first-time researchers employing a combination of intuition and agentic tools tend to find more interesting bugs, and that obtaining eligibility for the new tier demands deep architectural intuition and AI-assisted approaches. He also highlighted that researchers must use a deterministic proof-of-root mechanism via a designated service account to cryptographically prove unauthorized access.