Cloud Bug Hunters Can Now Earn $250,000
Google's expanded bounty program sets a verifiable proof-of-root standard for the most severe infrastructure flaws, in effect as announced.
Updated on Nov. 2, 2026 in Cybersecurity
Google expanded its Cloud Vulnerability Reward Program with a top-tier reward of $250,000 for root-in-cloud findings, meaning security weaknesses that could lead to full administrative control. The program change is a policy and bounty update, not a new product capability, and it is in effect as announced.
Why it matters
Bug bounty rules define how security researchers can legally test cloud infrastructure, and a fixed, cryptographically verifiable proof-of-root standard is a notable step toward more structured testing of hyperscale platforms. The higher payout signals that major cloud providers are pricing the most severe infrastructure flaws well above conventional web vulnerabilities.
The top-tier payout is $250,000, awarded for weaknesses that could allow arbitrary tenant or project takeover. Google says it will verify eligibility through a deterministic proof-of-root mechanism tied to a designated service account, though the source gives no benchmark for how often that threshold is reached.
The players
Google operates Borg, its underlying production infrastructure, and runs the Cloud Vulnerability Reward Program that now offers a $250,000 top-tier payout.
The details
Under the new rules, a researcher must demonstrate unauthorized access by cryptographically proving control of a designated service account, which serves as the verifiable proof of root. Qualifying exploits cannot rely on existing project access, previously stolen credentials, or social engineering. Once a researcher achieves remote code execution in Borg, Google's underlying production infrastructure, they must stop all probing immediately, since escalation, credential extraction and lateral movement lead to disqualification.
Timeline
2 November 2026: Google announced the $250,000 root-in-cloud reward expansion.
The Tech Race
Google's expansion places its cloud bounty program among efforts by large providers to formalize testing rules for their own production systems. The explicit proof-of-root standard and the $250,000 tier raise the bar for what counts as a rewardable critical finding.
Security researchers now have a published rule set for claiming the $250,000 top-tier reward, including a required proof-of-root method and explicit limits on what testing may touch. Cloud customers are not directly affected by the rule change, since the rules govern how researchers test Google's own infrastructure.
The takeaway
Watch whether the proof-of-root standard is adopted or referenced by other cloud providers' bounty programs in the coming months. Researchers and security teams should review the updated Cloud VRP terms before submitting any findings.
Further reading
For broader context on how companies are structuring security testing, explore our Cybersecurity coverage.
