Google Offers $250,000 for Cloud Root Exploits
Google expanded its Cloud Vulnerability Reward Program with a top-tier payout for flaws enabling full administrative control.
Updated on Nov. 2, 2026 in Cybersecurity
Google expanded its Cloud Vulnerability Reward Program with a $250,000 top-tier reward for security weaknesses that could lead to full administrative control. The company also added root-in-cloud validation criteria to its Cloud VRP page.
Why it matters
High incentives require clear, safe rules of engagement, Google says, so researchers do not test exploits against real customer projects. The criteria aim to channel security research toward provable, contained findings.
The reward is set at $250,000 for flaws enabling full arbitrary tenant or project takeover, validated through a deterministic proof-of-root against a designated service account. Google has not disclosed how many submissions have met the threshold since the criteria were added.
The players
Google is the Alphabet subsidiary that operates the Cloud platform and its Vulnerability Reward Program, and it runs Borg as its underlying production infrastructure.
The details
Qualifying exploits must not rely on pre-existing project access, previously compromised credentials, or user interaction. Remote code execution in Borg, Google's underlying production infrastructure, will be evaluated, but researchers must halt probing immediately upon achieving execution there, and escalation, credential extraction, or lateral movement results in disqualification.
Timeline
November 2, 2026: Google announced the $250,000 root-in-cloud reward expansion.
The Tech Race
The expansion extends Google's existing Cloud Vulnerability Reward Program by adding a $250,000 top tier and formal root-in-cloud validation rules. It positions Google's cloud bounty against rival providers by offering a clearly defined, provable standard for the most severe class of flaws.
Security researchers now have a defined, provable target and clear limits on what testing is allowed, which affects how they approach Google Cloud products. Cloud customers benefit indirectly because qualifying flaws must be proven without touching real customer projects.
The takeaway
Researchers hunting cloud flaws should stop all probing the moment they reach execution in production infrastructure and document proof against the designated service account. Following the defined boundaries protects both the researcher's eligibility and the customers whose projects must stay untouched.
Further reading
Explore more in Cybersecurity coverage on how companies reward vulnerability research.
