Google Cloud raises top bug bounty to USD $250,000 - IT Brief UK
Google Cloud has increased its maximum vulnerability reward to USD $250,000 for researchers who demonstrate full administrative control over arbitrary Google Cloud organizations without prior access.
The new tier specifically targets security researchers who can demonstrate full administrative control over arbitrary Google Cloud organizations or projects without prior access or special project setup. Qualifying exploit paths must not rely on leaked, phished or stolen credentials, user interaction, social engineering or an existing foothold in a victim project.
The move comes as large technology groups deal with heavier volumes of vulnerability submissions. Automation tools have increased the number of reports sent to Google Cloud's programme, although the number of valid vulnerability reports has remained stable over the past 18 months.
Google Cloud has also set technical rules for validating claims designed to avoid affecting production systems. Researchers seeking the top reward must use a designated service account and provide cryptographic proof of unauthorised access rather than test against customer projects.
Research Landscape Shift
Chris Betz, Chief Information Security Officer at Google Cloud, said the change reflects a shift in how security research is carried out. Google Cloud is trying to encourage work on tenant-isolation bypasses and cross-service logic flaws, which are harder to identify through automated scanning alone.
This is a recognition of how the field of security research has changed over the past year. We value quality submissions from anyone, and we've seen that the combination of human creativity and agentic power is much richer than either on its own.
Disclosure Pressure
Google Cloud also warned about the risks of rushed public disclosure. Cote said pressure to publish first may encourage researchers or security firms to release details of unmitigated flaws before vendors have had time to address them, increasing risk for users.
He pointed out that newly public vulnerability details can be turned into working exploits more quickly, especially with the help of LLMs. This increases the importance of coordinated disclosure and faster remediation once vulnerabilities are made public.
With the influx of new submissions, I worry about a growing pressure to rush to publish. Something that concerns me because we're already seeing early indications of it.
Security Recommendations
For corporate security leaders, Cote said the growth of agent-generated submissions means triage systems must distinguish between plausible but incorrect reports and genuine flaws. He also said remediation timelines should shrink once a vulnerability is public.
Cote recommended three key actions: prepare vulnerability triage workflows for agent-generated submissions, compress remediation timelines once vulnerabilities become public, and hold security partners and vendors to high standards of coordinated disclosure.
Related
