Google offers $250,000 for flaws that give full admin control of Google Cloud
The top-tier reward applies only to exploits that work without existing access, stolen credentials or user action, and sets strict limits on how researchers may test.
Google has added a top-tier $250,000 reward to its Cloud Vulnerability Reward Program for flaws that could grant full administrative control over any Google Cloud organization or project. To qualify, an exploit must not rely on existing project access, stolen credentials, or user interaction, and remote code execution inside Borg, the company's production infrastructure, also falls under review. Researchers who reach code execution in Borg must stop probing immediately and may not escalate, pull production credentials, or move laterally, or they will be disqualified. Google will judge submissions by whether they show full arbitrary tenant or project takeover is possible, and it provides a designated service account so researchers can prove access without touching real customer projects. Google's bounty program lead said first-time researchers using their own judgment alongside AI tools are now turning up more interesting bugs than novices did two years ago.
Why it matters
The reward raises the price of finding the most serious class of Cloud flaws, the kind that would let an outsider take over any customer's organization or project. Strict rules, including disqualification for moving into production credentials after reaching code execution in Borg, and a designated service account for proving access without touching real customer projects, show Google wants researchers to demonstrate the risk without exposing customer data. Google's bounty lead also reports that first-time researchers using AI tools are finding more interesting bugs than novices did two years ago, suggesting the pool of people able to find such flaws is growing.
Matters or hype?
Does this story matter, or is it hype? Vote before you see what everyone else said.