Google Cloud has expanded its Vulnerability Reward Program (VRP) with a new $250,000 Root-in-Cloud tier, announced in a Q&A between Google Cloud CISO Chris Betz and VRP lead Michael Cote at the Escal8 conference in Singapore. The tier is designed to recognize high-impact architectural research that goes beyond what automated scanners can find — in particular tenant-isolation bypasses and complex cross-service logic flaws. Cote explains that while automated tools generate high volumes of low-impact noise, researchers who combine human intuition with agentic tools are finding more interesting bugs on average than novices did two years ago, and the new bounty is meant to challenge the community to pursue deeper architectural findings.

To qualify for the reward, a researcher must demonstrate full administrative control — equivalent to roles/owner or complete IAM control — over arbitrary Google Cloud organizations or projects, without prior access or special project setup. The exploit path cannot rely on pre-existing access, leaked, phished, or stolen credentials, user interaction, or social engineering. For safe and reproducible validation, Google defined a deterministic proof-of-root mechanism using a designated service account, allowing cryptographic proof of unauthorized access without touching production environments. Reports that demonstrate RCE in underlying Google production infrastructure (Borg) or root-in-prod are also automatically evaluated for Root-in-Cloud eligibility. However, researchers must stop all probing immediately upon achieving execution in Borg; escalation, extracting production credentials, and lateral movement are prohibited and lead to disqualification. The VRP panel analyzes the initial entry point, execution context, and attack surface to determine whether full arbitrary tenant or project takeover is achievable.

The conversation also covers how automation has affected the VRP. Cote says the number of valid vulnerability reports has remained stable over the last 18 months, but the total volume of reports has grown tremendously. Automation has flattened the barrier to entry and brought in more first-time researchers, which puts pressure on experienced researchers to move faster and produce more impactful findings. Cote notes that their Google Threat Intelligence Group has observed a sharp rise in exploited n-day vulnerabilities, not zero-days, and that threat actors appear to be using LLMs to quickly turn newly-public vulnerability details into working exploits. Against this backdrop, he is concerned about growing pressure to rush publication, warning that disclosing an unmitigated vulnerability well ahead of the standard 90-day coordinated disclosure window gives attackers the knowledge and time they need to target customers. Project Zero helped establish the 90-plus-30-day policy, and that discipline is now more important than ever.

Betz asks what enterprise CISOs should take away. Cote offers three recommendations: prepare vulnerability triage workflows for agent-generated submissions so that plausible-sounding hallucinations don’t get stuck in backlogs; compress remediation timelines once a vulnerability becomes public because autonomous technology shortens the time from disclosure to working exploits; and hold security partners and vendors to high standards of coordinated disclosure. He argues that rushing to be first works against a security company’s self-interest; customers will ultimately avoid organizations that put them and the ecosystem at risk.

The newsletter also includes a round-up of recent Google Cloud security and threat-intelligence updates, including agentic vulnerability discovery at Google, Wiz Sensor for GKE in preview, IAM Helper agent skills, VPC Service Controls enhancements, Confidential G4 GPUs, and a GTIG and Mandiant report on ephemeral supply chain tampering.