Google has introduced a top-tier reward of up to US$250,000 in its Cloud Vulnerability Reward Program (VRP), aimed at a rare class of high-impact architectural flaws the company is calling "Root-in-Cloud" bugs, according to BleepingComputer.
The figure is the headline number, but what matters is the ratio: a very large payout attached to a bug category that only a small number of researchers realistically qualify to claim. Root-in-Cloud bugs are not ordinary injection flaws or misconfigurations. They are structural failures in how a cloud platform is put together — for example, a path that lets one tenant's workload influence or impersonate another across a trust boundary, a control-plane/data-plane separation that fails under specific conditions, or an abuse of internal metadata services that yields privileges far beyond what the caller should hold. In plain terms: flaws that let an attacker climb from a single foothold to something resembling root across a cloud environment.
Why Google is paying more
The economics are straightforward. Architectural flaws of this kind have a large blast radius — a single defect can potentially affect many customers at once — and they are precisely the kind of bug providers are worst at finding through internal testing and routine auditing. They tend to hide in the seams between services, teams, and tenancy boundaries rather than in any single component. A bounty at this level reads as a recruitment signal: Google is effectively saying it sees residual risk in its own cloud architecture and is willing to pay a premium to bring external researchers to bear on it.
Scope and caveats
According to BleepingComputer's summary of Google's Cloud VRP page, the $250,000 figure is the ceiling for qualifying Root-in-Cloud submissions, with rewards scaled by severity and impact, and subject to the program's standard eligibility rules — including requirements around duplication, disclosure timelines, and what counts as an original finding. Whether the reward stacks on top of existing Cloud VRP or general VRP payouts, and whether the figure represents a genuinely new tier rather than an uplift to a previous cap, should be confirmed directly against Google's primary Cloud VRP documentation before the number is treated as final.
How it compares
Google already operates a general VRP alongside its cloud-specific program, and the cloud tier is where Google's spending has increasingly concentrated as GCP has grown. Rival hyperscalers run their own programs: Microsoft's bug bounty and the Microsoft Identity Bug Bounty, Apple's security bounty, and Meta's program all publish maximum payouts, though few are structured around a single named architectural bug class in the way this tier appears to be. Google has not published a direct comparison against rival hyperscaler bounty schedules, so readers weighing one program against another should check each vendor's own published terms. The competitive comparison matters because bounty ceilings are one of the few public signals of where a vendor believes its blind spots are.
What it means for hunters
For researchers, the practical takeaway is that the bar has moved up, not just the reward. Earning a top-tier architectural payout requires reconnaissance-heavy, systems-level work — mapping tenancy boundaries, tracing privilege flows across services, and building a convincing exploit chain — rather than fast, tool-driven discovery. The qualifying pool is small by design.
據 BleepingComputer 報導，Google 已在其 Cloud Vulnerability Reward Program（VRP）中推出最高達 25 萬美元的頂級獎金，針對一類罕見但影響深遠的架構漏洞，Google 稱之為「Root-in-Cloud」bug。
這個數字固然是焦點，但真正關鍵在於其比例：一筆極為豐厚的獎金，掛鈎在一個實際上只有少數研究人員具備資格領取的 bug 類別之上。Root-in-Cloud bug 並非一般的 injection 漏洞或設定錯誤，而是雲端平台整體架構上的結構性失效——例如，某條路徑令一個 tenant 的 workload 可以跨越 trust boundary 影響或冒充另一個 tenant、control plane 與 data plane 的分隔在特定條件下失效，又或對內部 metadata service 的濫用令權限遠超呼叫者應有的水平。簡單來說：這類漏洞可讓攻擊者由單一立足點攀升至在整個雲端環境中近似 root 的地位。
為何 Google 願意付出更高代價
經濟邏輯相當直接。這類架構漏洞的 blast radius（爆炸半徑）極大——單一缺陷可能同時影響大量客戶——而且它們恰恰是雲端供應商透過內部測試和例行審計最難發現的 bug 類型。這類漏洞往往藏身於服務、團隊與 tenant 邊界之間的縫隙，而非任何單一元件之內。這個級別的賞金可被視為一個招募信號：Google 實際上是在表示，其自身雲端架構仍存在殘餘風險，願意支付溢價，引入外部研究人員加以調查。
適用範圍及注意事項
根據 BleepingComputer 對 Google Cloud VRP 頁面的摘要，25 萬美元是符合資格的 Root-in-Cloud 提交的上限，實際獎金會按嚴重程度和影響範圍調整，並須遵守該計劃的標準資格規則——包括有關重複提交、披露時限，以及何謂原創發現的規定。該獎金是否會疊加於現有 Cloud VRP 或一般 VRP 獎金之上，以及這個數字究竟代表一個全新的級別，抑或只是在原有上限上調，均應直接查閱 Google 官方 Cloud VRP 文件確認後，方能視為最終定案。
與其他計劃的比較
Google 除了雲端專屬計劃外，一直有營運一般 VRP；隨著 GCP 業務增長，Google 的相關開支亦日益集中於雲端級別。競爭對手的 hyperscaler 亦有各自的計劃：Microsoft 的 bug bounty 及 Microsoft Identity Bug Bounty、Apple 的 security bounty，以及 Meta 的計劃均公布最高獎金，不過鮮有計劃如這個級別般，圍繞一個具名的架構 bug 類別來架構。Google 並未發布與競爭對手 hyperscaler 獎金表的直接比較，因此讀者如要衡量各計劃，應查閱各供應商自行公布的條款。這種比較之所以重要，是因為獎金上限是外界少數能觀察到供應商自認盲點所在的公開訊號之一。
對漏洞獵人的啟示
對研究人員而言，實際的啟示是：門檻提高了，而不只是獎金提高。要獲取頂級架構漏洞獎金，需要以深入偵察為主、系統層面的工作——包括繪製 tenant 邊界、追蹤跨服務的權限流向，以及構建具說服力的 exploit chain——而非倚賴快速、工具驅動的發現。符合資格的入圍人數，從設計上就注定是少數。