Google Cloud VRP adds new $250,000 reward for Root-in-Cloud bugs

Google has expanded its Cloud Vulnerability Reward Program (VRP) by introducing a new top-tier financial reward designed to address high-impact architectural security flaws.

• A new $250,000 top-tier reward is available for Root-in-Cloud security bugs.
• Researchers must prove full administrative control over arbitrary GCP organizations without prior access.
• Exploits must not rely on compromised credentials, social engineering, or user interaction.
• Google awarded a record-breaking $17.1 million to security researchers in 2025.

Details of the Root-in-Cloud Reward Tier

Starting this month, security researchers can earn $250,000 for discovering Root-in-Cloud bugs. This category includes tenant-isolation bypasses and complex cross-service logic flaws that grant attackers full administrative control over arbitrary Google Cloud organizations.

Chris Betz, Google Cloud's Chief Information Security Officer, stated that earning this premier reward requires demonstrating full administrative control, equivalent to 'roles/owner' or complete IAM control, over arbitrary Google Cloud organizations or projects without any prior access or special project setup.

Strict Rules of Engagement and Safety

To qualify for this substantial payout, exploits cannot depend on prior access to the victim project, compromised credentials, social engineering, or user interaction. Furthermore, researchers achieving execution on Google's production infrastructure must cease probing immediately.

Cloud VRP Lead Michael Cote emphasized that high incentives require clear and safe rules of engagement, noting that the company never wants researchers testing exploits against real customer projects. Instead, Google implemented a deterministic proof-of-root mechanism using a designated service account for cryptographic verification.

Context and Growth of Google Bug Bounty Programs

Google has rewarded thousands of security researchers worldwide with more than $81.6 million since launching its first Vulnerability Reward Program in 2010. In 2025 alone, the company distributed a record-breaking $17.1 million to over 700 security researchers.

This expansion reflects Google's ongoing commitment to cloud security and follows recent adjustments to its vulnerability reward ecosystem, including the temporary pause of its open-source bug bounty program due to automated spam surges, reinforcing the focus on high-value, verified architectural research.