Google Offers $250,000 Bug Bounty for Full Google Cloud Project Takeover Vulnerabilities

Google has announced a $250,000 reward, called the “Root-in-Cloud” program, for researchers who can demonstrate complete administrative takeover of arbitrary Google Cloud projects or organizations without prior access.

Google announced the initiative on October 30 to address architectural vulnerabilities that could compromise tenant isolation or cause harmful interactions between cloud services.

The program emphasizes research that combines human expertise with advanced tools. Google Cloud’s Chief Information Security Officer, Chris Betz, and Cloud Vulnerability Response Program lead, Michael Cote, described the initiative as an incentive for discoveries beyond automated scanning, with a focus on tenant isolation bypasses and complex flaws in cross-service logic.

Google Offers $250,000 Bug Bounty

To qualify for the reward, researchers must demonstrate administrative control equivalent to Google Cloud’s “roles/owner” role or complete Identity and Access Management control over arbitrary projects or organizations. The attack must succeed without any special configuration of the victim’s environment.

Eligible exploitation methods cannot rely on existing access, prior footholds within the target project, or leaked or stolen credentials, phishing, social engineering, or any form of user interaction. These restrictions differentiate this reward from conventional privilege escalation, which typically begins with an authenticated identity.

For comparison, the patched ImageRunner Cloud Run vulnerability required existing permissions to modify service revisions and impersonate service accounts. The new tier instead demands an attack path that crosses the initial access boundary without those prerequisites.

Google’s Cloud Vulnerability Reward Program rules provide the technical validation requirements. Researchers must use a designated service account to produce cryptographic proof of unauthorized access, rather than test exploits against real customer projects.

Reports demonstrating remote code execution in Google’s underlying Borg production infrastructure, or achieving root-in-prod, will automatically receive evaluation for Root-in-Cloud eligibility. However, researchers must immediately stop probing once they achieve any code execution in Borg.

Further escalation, production credential extraction, and lateral movement are prohibited and can disqualify researchers. Google’s review panel will assess the initial entry point, execution context, and exposed attack surface to determine whether arbitrary tenant or project takeover is achievable.

This evaluation process allows researchers to establish impact without attempting a potentially disruptive compromise of production systems.

Cross-service trust remains an important research area. The patched ConfusedComposer vulnerability illustrated how package installation workflows could expose privileged Cloud Build identities. However, exploitation required existing Composer update permissions.

Cote said valid Google Cloud VRP reports have remained stable over the past 18 months, while overall submissions have increased substantially. Automation has lowered entry barriers but also increased triage noise.

The emphasis on validated findings parallels Google’s PageBreak AI agent, which uses deterministic testing to confirm suspected vulnerabilities before reporting them as genuine security issues.

Google also warned that competitive pressure to publish unmitigated flaws can give attackers exploitable information before customers are protected.

For enterprise security teams, Cote recommended preparing triage pipelines for agent-generated reports, separating plausible hallucinations from reproducible vulnerabilities, and accelerating remediation after public disclosure.

He also urged organizations to demand coordinated disclosure from security partners, keeping customer safety central as autonomous vulnerability discovery and exploitation capabilities continue to mature across the industry.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.