Google Cloud offers $250,000 bug bounty for credential-free takeover - Pasquale Pillitteri

The new Root-in-Cloud tier, announced on October 30, 2026, targets researchers who can seize complete administrative control over any Google Cloud project or organization starting from zero credentials. This represents a significant increase from the previous maximum of $75,000 for full project takeovers.

Google Cloud provides critical infrastructure to businesses, banks, and public agencies, including major clients like BNP Paribas and Revolut. The vulnerability reward program operates as an official bug hunt where researchers report flaws, Google verifies them, and pays rewards based on severity.

Technical requirements

To qualify for the maximum payout, researchers must demonstrate full administrative control equivalent to the 'roles/owner' role or complete dominion over Identity and Access Management (IAM) systems. The attack must work against arbitrary Google Cloud projects, not just test environments.

Google specifically targets two families of vulnerabilities: breaches of tenant isolation and logic errors that span multiple cloud services. The proof mechanism uses a designated service account to demonstrate unauthorized access without touching production environments.

Strict testing protocols

The $250,000 bounty requires researchers to start from outside the target project with no prior access, leaked credentials, or social engineering. Attacks that already have a foothold in the target project fall under lower reward tiers, with maximum payouts of $20,000.

Researchers who achieve remote code execution in Borg, Google's internal data center system, must stop testing immediately. Escalating privileges, extracting production credentials, or moving laterally to other systems results in disqualification.

Rationale behind the increase

The bounty increase responds to a surge in low-quality AI-generated reports while the number of valid submissions has remained steady. Google aims to attract high-impact research that combines human creativity with AI capabilities.

The company also emphasizes responsible disclosure, warning that publishing unfixed vulnerabilities before the standard 90-day window puts customers at risk. For users, the increased incentive means critical flaws are more likely to be discovered and fixed before malicious actors can exploit them.

Impact and expectations

The $250,000 payout makes reporting such vulnerabilities to Google more attractive than withholding them, potentially shifting the economics of security research. However, Google has not specified how many such cases it expects to reward or when the first payment might occur.

In 2025, Google paid researchers more than $17 million across all its vulnerability reward programs, with the Cloud VRP contributing approximately $3.57 million to 143 researchers. The new tier represents a significant commitment to cloud security as adoption continues to grow.