Google adds $250,000 Borg root-in-cloud reward

Google has expanded its Cloud Vulnerability Reward Program by introducing a new $250,000 top-tier reward for security weaknesses leading to full administrative control, tenant takeover, or remote code execution in Borg. To qualify, researchers must use a deterministic proof-of-root mechanism via a designated service account without relying on pre-existing access, compromised credentials, or user interaction. Google Cloud CISO Chris Betz noted that identifying complex cross-service logic flaws requires a combination of human intuition and agentic systems. Open article →