Proof-of-root: Clear, cryptographic validation
To make testing safe, clear, and reproducible, without impacting production environments, we have defined technical criteria for validating root-in-cloud access.
Additionally, valid vulnerability reports demonstrating remote code execution (RCE) in underlying Google production infrastructure (Borg) or achieving root-in-prod will automatically be evaluated by the Google Cloud VRP panel for root-in-cloud eligibility.
Because code execution in Borg has the potential to impact service availability or cross-tenant data, researchers must halt all probing immediately upon achieving any execution in Borg. Escalation, extracting production credentials, and lateral movement are not allowed and will result in researcher disqualification.
The Google Cloud VRP panel will analyze the initial entry point, execution context, and attack surface to determine whether full arbitrary tenant or project takeover is achievable from that position, and award the bounty accordingly.
This new bounty tier reflects how security research continues to evolve, and the importance of continuing to recognize the most innovative and valuable security research. As part of those efforts, Google Security held its annual Escal8 conference in Singapore last week, and I had the opportunity to discuss the changing landscape with Michael Cote, Google Cloud’s vulnerability reward program lead.
The following transcript has been lightly edited.
Chris Betz: You are at Escal8 in Singapore announcing the new $250,000 Root-in-Cloud tier for our VRP. Why introduce this tier now, and what kind of research are you hoping to spark?
Michael Cote: This is a recognition of how the field of security research has changed over the past year. We value quality submissions from anyone, and we’ve seen that the combination of human creativity and agentic power is much richer than either on its own.
While automated scanners generate a high volume of low-impact noise, first-time researchers who pair human intuition with agentic tools are finding, on average, more interesting bugs than novices did two years ago. With the new Root-in-Cloud tier, we want to challenge the community and increasingly reward the complex, high-impact findings — like tenant-isolation bypasses and cross-service logic flaws — that require deep architectural intuition alongside agentic tools, because getting that information is essential to protecting our customers.
Chris Betz: Google Threat Intelligence Group (GTIG) recently shared research showing that monthly CVE disclosures have doubled as agentic tools mature. From your seat leading the Cloud VRP, how has automation technology impacted the reports we’ve received?
Michael Cote: It has transformed our intake volume, though not in the way many people assume. While the number of valid vulnerability reports submitted to the Google Cloud VRP has remained stable over the last 18 months, the total number of reports has grown tremendously.
Automation has helped democratize vulnerability discovery, and the barrier to entry has been rapidly flattening, something even our top researchers noted at Escal8. Because we’re seeing more researchers and more first-timers with interesting bugs, that creates pressure on more experienced researchers to move faster and bring more impactful findings — although their experience continues to be a key differentiator in success.
Chris Betz: I’ve been working with the research community for more than 20 years. One of the things I appreciate most is how much the community values making the world more secure. Bounty programs let us recognize this valuable work. How do you see the community changing as we move further into the agentic era?
Michael Cote: That shared commitment to making the world more secure is still the heart of this community, which is why the pressure to move faster is something we have to watch closely. As our GTIG colleagues found, the sharpest rise in the number of exploited vulnerabilities comes from n-days, not zero-days.
Open source accounts have suggested that threat actors are using LLMs to rapidly turn newly-public vulnerability details into working exploits. When triage teams are already working through a surge in report volume, disclosing an unmitigated vulnerability well ahead of the standard 90-day coordinated disclosure window gives attackers the exact knowledge and time window they need to target customers.
With the influx of new submissions, I worry about a growing pressure to rush to publish. Something that concerns me because we’re already seeing early indications of it. Because LLMs lower the barrier to finding bugs in source-available software, researchers worry that waiting to verify risks will allow someone else to be first to publish. Even more concerning, that same competitive pressure can tempt even established security companies to disclose unmitigated vulnerabilities without coordination, and that rush puts our users directly at risk.
Project Zero helped establish the industry’s 90-plus-30-day responsible disclosure policy, and autonomous detection and exploitation capabilities make following coordinated disclosure more important than ever. In the long run, rushing to be first works against a security company’s own self-interest. Novel discoveries may bring temporary visibility, but customers will ultimately choose not to work with organizations that put them and the broader ecosystem at risk.
Chris Betz: When you offer a $250,000 bounty, how do you make sure researchers can validate their findings without putting customer environments or service availability at risk?
Michael Cote: High incentives require clear, safe rules of engagement. We never want researchers testing exploits against real customer projects. Instead, we created a deterministic proof-of-root mechanism using a designated service account. Researchers can cryptographically prove unauthorized access against that identity.
We’ve also updated our program rules to establish strict boundaries around underlying production infrastructure. If researchers think they are close to a breakthrough but are uncertain where the boundary lies, we encourage them to reach out. We are always more than happy to work with them to ensure they are recognized and rewarded for the value of their research without taking steps that would invalidate the bounty.
Chris Betz: What should enterprise CISOs take away from these trends? Especially those who run their own vulnerability management pipelines and partner with external researchers, what advice would you offer for navigating this AI inflection point?
Michael Cote: First, prepare your vulnerability triage workflows for agent-generated submissions. To keep valid reports from getting stuck in a backlog, security teams need ways to separate plausible-sounding hallucinations from real security risks.
Second, compress your remediation timelines once a vulnerability becomes public. Defensive patching and mitigations have to move faster because autonomous technology compresses the time from disclosure to working exploits.
Finally, hold your security partners and vendors to high standards of coordinated disclosure. It’s important that our industry continues to normalize agentic vulnerability research, but we must do so responsibly. Let’s continue to keep user safety at the center of everything we do.
For more information on the Google Cloud VRP, including detailed endpoint specifications, JSON payloads, and CLI examples, please check out our rules page.
