**Google** has amplified its commitment to cloud security by enhancing its **Cloud Vulnerability Reward Program (VRP)**. The program now offers a substantial $250,000 bounty for the most severe architectural security flaws, specifically targeting 'Root-in-Cloud' vulnerabilities. ### The Quarter-Million-Dollar Bounty Starting this month, security researchers can earn the premier reward for identifying **Root-in-Cloud** bugs. These include tenant-isolation bypasses and intricate cross-service logic flaws that enable attackers to achieve full administrative control over arbitrary **Google Cloud** organizations. **Chris Betz**, **Google Cloud's** Chief Information Security Officer (**CISO**), elaborated on the criteria: "To earn this premier reward, you must demonstrate full administrative control, the equivalent of 'roles/owner' or complete **IAM** control, over arbitrary **Google Cloud** organizations or projects with no prior access or special project setup." ### Targeting Core Infrastructure The scope of this top-tier reward also extends to vulnerabilities demonstrating remote code execution (**RCE**) within **Google's** underlying production infrastructure, known as **Borg**, or achieving 'root-in-prod.' Such findings will be automatically evaluated by the **Google Cloud VRP** panel for Root-in-Cloud eligibility. ### Strict Rules of Engagement To qualify for this significant reward, exploits must be independent of prior access to the victim project, compromised credentials, social engineering tactics, or any user interaction. Researchers who successfully achieve execution on **Google's** production infrastructure are required to cease further probing immediately. Escalating privileges, obtaining production credentials, or lateral movement are strictly prohibited and will result in disqualification. **Michael Cote**, **Cloud VRP Lead**, emphasized the necessity of these guidelines: "High incentives require clear, safe rules of engagement. We never want researchers testing exploits against real customer projects." Instead, **Google** has implemented a deterministic 'proof-of-root' mechanism utilizing a designated service account, allowing researchers to cryptographically prove unauthorized access against that identity without compromising live customer environments. Comprehensive details regarding the **Google Cloud VRP**, including endpoint specifications, JSON payloads, and CLI examples, are available on the official [rules page](https://bughunters.google.com/about/rules/google-friends/cloud-vulnerability-reward-program-rules#root-in-cloud-technical-validation). ### Recent Program Adjustments and Historical Payouts This expansion follows **Google's** decision in October to temporarily suspend submissions to its **Open Source Software Vulnerability Rewards Program (OSS VRP)** due to an overwhelming influx of AI-generated reports. Since its inception in 2010, **Google's** **Vulnerability Reward Programs** have awarded over $81.6 million to thousands of security researchers globally. In 2025 alone, **Google** disbursed a record-breaking $17.1 million to over 700 researchers, marking a 40% increase from the $12 million awarded in 2024.