Google adds $250,000 reward for cloud takeover vulnerabilities

Google has added a $250,000 reward for vulnerabilities that let attackers gain full administrative control over arbitrary Google Cloud organizations or projects. The new Cloud Vulnerability Reward Program tier starts this month and covers flaws such as failures to isolate customers and complex logic errors across services. Qualifying exploits cannot require prior access, compromised credentials, social engineering or user interaction. Researchers must use a designated service account to prove unauthorized access rather than test against real customer projects. Anyone who achieves execution on Google's production infrastructure must stop probing; further escalation, credential collection or movement through production systems leads to disqualification.