Researcher Arvin Shivram has earned $500,000 in bug bounties from Google’s Vulnerability Reward Program (VRP) by deploying an AI-powered fuzzing framework against Google’s internal API infrastructure, uncovering critical access-control flaws across multiple high-impact services in under 3 months.
The research began after Shivram was invited to bugSWAT Mexico in October 2025, which reignited his interest in Google’s attack surface.
Recognizing that Google publishes machine-readable discovery documents and API specifications similar to Swagger/OpenAPI docs for both public and internal services, Shivram saw an opportunity to automate API fuzzing at scale using AI.
Researcher Uses AI to Hack Google
Before any AI-assisted testing could begin, Shivram and collaborator Michael conducted extensive reconnaissance.
They scraped over 60,000 Android APKs (every version of every Google app ever released), built a custom Chrome extension to intercept live API traffic across 2,800+ Google domains, and harvested 3,600+ API keys embedded in Google’s own applications.
Using certificate transparency logs and brute-forced subdomain permutations, they identified 1,500+ live internal Google APIs, many hidden behind visibility labels that required specialized parameters like ?labels=GOOGLE_INTERNAL to reveal undocumented endpoints.
A critical technical breakthrough was reverse-engineering Google’s proprietary First Party Authentication (FPA) v2 system. Michael discovered that Google had accidentally leaked source maps for their internal gapix library on android-review.googlesource.com, exposing the SHA-1 token generation algorithm.
This allowed the researchers to craft valid FPA authorization headers, unlocking authenticated access to internal APIs that were never meant to be publicly accessible.
Shivram integrated all 1,500 discovery documents as MCP (Model Context Protocol) tools. He fed them to an AI model, effectively instructing it to behave as a Google VRP security researcher, as reported by Brutecat.
The AI was given tools to probe_api, report_vulnerability, and confirm_testing_complete, along with a tightly engineered system prompt refined over a month to minimize false positives.
The approach evolved through several iterations. Initially, the AI produced excessive noise, flagging existence-enumeration oracles and 500-series errors as vulnerabilities.
After group-based classification of endpoints and strict reporting rules (report only confirmed IDOR leaks that expose real user data or broken access controls), the AI’s accuracy exceeded 50% per finding. Every reported bug included operation IDs linked to actual request/response pairs, making manual verification a single click in Shivram’s custom API Explorer UI.
The most severe finding was a Google Voice Account Takeover (ATO); the gfibervoice-pa.googleapis.com endpoint required zero authentication, allowing anyone with a victim’s Gaia ID to retrieve their phone number, Gmail recovery address, and call forwarding settings via a single curl command.
The API also allowed assigning a Google Voice number to any target account, a prerequisite for SIM-swap-style attacks. Google triaged this as P0/S0 (highest severity), patched it within hours, and awarded $20,000.
The AI also uncovered an AdExchange (Google Ads) ATO chain, an internal endpoint that exposed a list of all AdExchange publisher accounts, and a sandbox environment lacked proper access controls, enabling cross-account data access across Google’s advertising platform.
A separate access control vulnerability in a support.google.com content management API, reachable only via *.corp.google.com origins, leaked internal technology account manager (TAM) assignments and was awarded $6,000.
Researchers & Rewards
The table below highlights documented findings from the research with their confirmed bounty rewards:
| # | Vulnerability | Affected Service | Severity | Bounty Awarded |
|---|---|---|---|---|
| 1 | Google Voice ATO – unauthenticated PII disclosure & phone number takeover | gfibervoice-pa.googleapis.com | P0/S0 Critical | $20,000 |
| 2 | AdExchange ATO – broken access control on ad publisher accounts | adexchangebuyer.clients6.google.com (sandbox) | Critical | Undisclosed (part of $500K total) |
| 3 | TAM data leak – access control bug exposing internal account manager assignments | contentmanager.clients6.google.com | High | $9,000 |
| 4 | API Explorer IDOR – access control bug leaking assigned TAMs | Internal People API endpoint | Medium | $6,000 |
| 5 | Multiple additional API access control flaws across 1,500+ internal APIs | Various *.googleapis.com | Medium–Critical | Remaining of $500,000 total |
The campaign marks a turning point in automated vulnerability research, demonstrating that AI, when combined with deep API reconnaissance, a precisely tuned system prompt, and human-in-the-loop validation, can reliably discover real-world, high-severity bugs at a scale no individual researcher could achieve manually. All reported vulnerabilities were confirmed fixed by Google before disclosure.
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.
.){kind=link}