Cybersecurity
Google raises Cloud VRP top reward to $250,000
Google said researchers can now earn $250,000 for Root-in-Cloud flaws that expose full administrative control, while also tightening rules around testing and automatic review of some production-infrastructure exploits.
- Google expanded its Cloud Vulnerability Reward Program this month and set a $250,000 top reward for Root-in-Cloud bugs.
- The reward covered tenant-isolation bypasses and cross-service logic flaws that could give full administrative control over arbitrary Google Cloud organisations or projects.
- Chris Betz said the top award required full administrative control, or the equivalent in IAM terms, without prior access or special project setup.
- Google said reports showing remote code execution in Borg or root-in-prod would be reviewed for eligibility, but the exploits could not rely on prior access, compromised credentials, social engineering or user interaction.
- Google said it suspended submissions to its Open Source Software Vulnerability Rewards Program in October after a surge of AI-generated reports, and that it has paid more than $81.6 million to researchers since 2010.
Google expanded its Cloud Vulnerability Reward Program this month and raised the top payout to $250,000 for what it called Root-in-Cloud bugs. The company said the category covered tenant-isolation bypasses and cross-service logic flaws that could lead to administrative control of arbitrary Google Cloud organisations or projects.
Chris Betz, Google Cloud’s chief information security officer, said the highest reward required full administrative control, or the equivalent of roles/owner or full IAM control, without any prior access or special project setup. He also said reports showing remote code execution in Borg or root-in-prod would be considered for the same tier.
Michael Cote, who leads the Cloud VRP, said researchers had to stop once they reached Google’s production infrastructure and could not escalate, obtain production credentials or move laterally. Google said it used a designated service account so researchers could prove unauthorised access cryptographically, and it said it suspended submissions to its Open Source Software Vulnerability Rewards Program in October after a surge of AI-generated reports.
Named in this story
People
- Chris Betz
- explained the eligibility bar for the new reward
- Michael Cote
- said researchers must stop probing after reaching production infrastructure
Companies
- expanded the Cloud Vulnerability Reward Program
Organisations
- Google Cloud
- set the criteria for the new top-tier reward
Products and systems
- Cloud Vulnerability Reward Program
- gained a $250,000 reward tier for Root-in-Cloud bugs
- Borg
- was named as Google’s underlying production infrastructure
- Open Source Software Vulnerability Rewards Program
- had submissions suspended in October after AI-generated reports flooded in
How the source tells it
Mostly a plain announcement, with light vendor boosterism in Google’s own framing of the new reward and proof mechanism.
- vendor boosterism Google’s quoted language presents the award as a premier tier and the testing rules as carefully engineered