Google adds a $250,000 tier for high-impact cloud security research

Google Cloud has introduced a $250,000 Root-in-Cloud reward within its vulnerability reward program. The tier targets high-impact architectural research that can demonstrate full administrative control over arbitrary cloud organizations or projects.

Eligibility is narrower than finding any cloud vulnerability. Google says the attack path cannot rely on an existing foothold in the victim project, stolen credentials or user interaction. The program also provides a defined validation mechanism intended to demonstrate impact without testing against real customer projects.

The announcement targets research into tenant-isolation bypasses and complex cross-service weaknesses. Google describes the reward as recognition for high-impact architectural research.

Google says researchers must halt probing immediately if they achieve execution in its underlying production infrastructure. Escalation, extraction of production credentials and lateral movement are prohibited in that situation. The program's rules describe the validation process for assessing eligibility.