Cybersecurity

Google Adds $250,000 Cloud VRP Reward for Architectural Flaws

Google has introduced a new $250,000 top-tier reward under its Cloud Vulnerability Reward Program (VRP) to target high-impact architectural security flaws, tenant-isolation bypasses, and complex cross-service logic issues.

Radwan AbdulhadiEditor and technology writer

Published: November 3, 2026 · Updated: November 3, 2026 · 3 min read

Google Adds $250,000 Cloud VRP Reward for Architectural Flaws — Image: BleepingComputer

Expanding the Cloud VRP with Top-Tier Incentives

Google has expanded its Cloud Vulnerability Reward Program (VRP) by introducing a new $250,000 top-tier reward aimed at high-impact architectural security flaws. Starting this month, security researchers can earn this premier payout by uncovering Root-in-Cloud bugs, which include tenant-isolation bypasses and intricate cross-service logic issues that allow attackers to secure full administrative control over arbitrary Google Cloud organizations.

According to Google Cloud's Chief Information Security Officer (CISO), qualifying for this premier reward requires demonstrating complete administrative control, comparable to 'roles/owner' or full IAM control, over arbitrary Google Cloud organizations or projects without prior access or special project setup.

Validation Rules and Borg Execution Criteria

To qualify for the $250,000 reward, exploit paths cannot rely on prior access to a victim project, compromised credentials, social engineering, or user interaction. In addition, valid vulnerability reports demonstrating remote code execution (RCE) in Google's underlying production infrastructure, known as Borg, or achieving root-in-prod will be automatically evaluated for root-in-cloud eligibility.

Google has enforced strict rules of engagement regarding production infrastructure. Researchers achieving code execution in Borg must halt all probing immediately. Escalation, extraction of production credentials, and lateral movement are strictly prohibited and will lead to immediate disqualification from the program.

Google Introduces $250,000 Root-in-Cloud Bug Bounty Reward — Image related to the report from SecurityWeek · Source: SecurityWeek

Safe Rules of Engagement and Proof-of-Root

Google Cloud VRP Lead Michael Cote emphasized the necessity of safe boundaries given the high financial incentives. The company has made it clear that researchers must never test exploits against real customer projects. Instead, Google established a deterministic proof-of-root mechanism using a designated service account, allowing researchers to cryptographically prove unauthorized access against that specific identity.

Detailed information regarding endpoint specifications, JSON payloads, and CLI examples for the Google Cloud VRP can be found on the rules page.

Broader Context in Google Bug Bounty Programs

This latest expansion follows Google's recent adjustment to its broader bug bounty ecosystem, which included the suspension of submissions to its Open Source Software Vulnerability Rewards Program (OSS VRP) following a significant surge of AI-generated bug reports.

Since launching its initial Vulnerability Reward Program in 2010, Google has rewarded thousands of security researchers globally with over $81.6 million. In 2025 alone, the tech giant awarded a record-breaking $17.1 million to more than 700 security researchers, reflecting a 40% increase compared to 2024 when total bounties reached $12 million.

Sources

BleepingComputerGoogle adds new $250,000 Cloud VRP reward for Root-in-Cloud bugs
SecurityWeekGoogle Introduces $250,000 Root-in-Cloud Bug Bounty Reward