Loading story…
Google has introduced a new bug bounty initiative specifically targeting vulnerabilities in its artificial intelligence (AI) products and services. The program, known as the AI Vulnerability Reward Program (AI VRP), is designed to incentivize security researchers to identify and report security flaws, abuse vectors, and high-impact vulnerabilities within Google’s AI ecosystem. The scope of the program includes flagship AI products such as Google Search, Gemini Apps across web and mobile platforms, and core Google Workspace applications like Gmail, Drive, Meet, and Calendar. Additional in-scope products include AI Studio, Jules, and other AI integrations within Google’s suite. Rewards for valid vulnerability reports range from $500 to $30,000, with the highest payouts reserved for novel, high-impact discoveries, such as those enabling rogue actions or sensitive data exfiltration. For example, a report detailing a security bug that could trigger unauthorized actions in a flagship product can earn up to $20,000, while sensitive data exfiltration bugs can net $15,000. Lower-tier rewards are available for issues like phishing enablement, model theft, context manipulation, access control bypass, unauthorized product usage, and cross-user denial of service. Google’s security engineering managers highlighted that the new program is an extension of the existing Abuse Vulnerability Reward Program, but with a dedicated focus on AI-related threats. Since 2023, when Google first expanded its bug bounty scope to include AI, researchers have already earned over $430,000 for AI-related findings. The company hopes that a standalone program will clarify the types of AI vulnerabilities in scope and encourage more targeted research. Acceptable reports include attacks that modify accounts or data, indirect prompt injections, phishing vectors, model theft, and persistent manipulation of AI environments. The program also addresses past confusion about what constitutes an in-scope AI bug, providing clearer guidelines for researchers. Google’s move comes as the company continues to integrate AI into more of its products, increasing the potential attack surface. The program is part of a broader effort to proactively secure AI systems and maintain user trust as AI adoption accelerates. By offering substantial financial incentives, Google aims to attract top security talent to help identify and mitigate emerging AI threats before they can be exploited in the wild. The launch of the AI VRP underscores the growing importance of AI security in the tech industry and sets a precedent for other companies to follow. Researchers interested in participating are encouraged to review the detailed reward tiers and submission guidelines provided by Google. The company has also committed to sharing lessons learned from the program to further strengthen the security of AI systems industry-wide.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Google introduced a new bug bounty program focused specifically on vulnerabilities in its AI products and services. The program offers rewards of up to $30,000 for eligible security findings affecting Google's AI systems.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
thecyberexpress.com
Open sourcezdnet.com
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
HackerOne has reported a significant increase in bug bounty payouts, distributing $81 million to ethical hackers worldwide over the past 12 months, marking a 13% year-over-year growth. The platform, which manages over 1,950 bug bounty programs for major organizations such as Anthropic, Crypto.com, General Motors, GitHub, Goldman Sachs, Uber, and the U.S. Department of Defense, has seen its top 100 programs alone pay out $51 million between July 2024 and June 2025. The average annual payout per active program reached nearly $42,000, with the top 10 programs accounting for $21.6 million. Individual researchers are now consistently earning six-figure sums, and the top 100 all-time earners collectively received $31.8 million. A notable trend in the past year has been the dramatic rise in AI-related vulnerabilities, with prompt injection flaws increasing by 540% and overall AI security issues rising by more than 200%. This surge is attributed to both the expansion of enterprise AI security initiatives—growing at nearly three times last year's pace—and the emergence of 'bionic hackers' who leverage AI tools to enhance vulnerability discovery. In 2025, 1,121 bug bounty programs on HackerOne included AI in their scope, representing a 270% year-over-year increase, and autonomous AI-powered agents submitted over 560 valid reports. While traditional vulnerabilities such as cross-site scripting (XSS) and SQL injection (SQLi) have declined, authorization-related flaws, including insecure direct object reference (IDOR) and improper access control, are on the rise. HackerOne's CEO, Kara Sprague, highlighted the unprecedented scale at which security issues are being discovered due to the integration of AI in both offensive and defensive security practices. The company also noted that 70% of surveyed researchers have incorporated AI tools into their workflows, further accelerating the identification of vulnerabilities. The data underscores a shift in the threat landscape, with AI security becoming a primary concern for organizations participating in bug bounty programs. The increased payouts reflect both the growing complexity of vulnerabilities and the value organizations place on proactive security research. HackerOne's annual report serves as a barometer for industry trends, indicating that as AI adoption accelerates, so too does the need for robust security measures and incentives for ethical hackers. The platform's continued growth and the rising sophistication of its researcher community suggest that bug bounty programs will remain a critical component of organizational security strategies. The findings also emphasize the importance of adapting vulnerability management processes to address emerging threats, particularly those associated with AI technologies. As enterprises expand their AI initiatives, the collaboration between organizations and the ethical hacking community is proving essential in mitigating evolving risks. The report concludes that the intersection of AI and cybersecurity will continue to shape the future of vulnerability discovery and remediation.
Jul 12, 2026
The Linux Foundation announced a **$12.5 million** initiative to strengthen open-source security and help maintainers manage a surge of low-quality, AI-generated vulnerability reports that are overwhelming triage and review processes. Funding comes from **Anthropic, AWS, GitHub, Google, Google DeepMind, Microsoft, and OpenAI**, and the program will be run through **Alpha-Omega** and the **Open Source Security Foundation (OpenSSF)** to improve remediation workflows, expand practical security support, and build longer-term resilience for widely used open-source software. Project leaders and maintainers said the volume of automated submissions has outpaced the capacity of many open-source teams, turning vulnerability handling into an operational burden. The effort follows complaints from groups including the **Python Software Foundation** and the **cURL** project, whose maintainer ended its bug bounty program after being flooded with poor-quality AI-generated reports; GitHub is also providing **$5.5 million** in Azure credits and support services, while Google said it plans to contribute security tools including **Big Sleep**, **CodeMender**, and research such as **Sec-Gemini**.
Jun 29, 2026
Google reported paying **$17.1 million** to **747** security researchers in 2025 through its Vulnerability Reward Program (VRP), bringing total payouts since 2010 to **$81.6 million**; the highest single reward in 2025 was **$250,000**. Google also highlighted expansion of bounty coverage into newer areas, including an **AI Vulnerability Rewards Program**, new Chrome VRP reward categories for AI-related bugs, and a rewards program tied to *OSV-SCALIBR* for identifying flaws in software dependencies. Separately, a Chainalysis report cited by KnowBe4 said **ransomware attacks increased 50% in 2025** even as observed on-chain ransom payments declined **8% YoY** to **$820 million** (with the caveat that attribution updates could push the total toward or above **$900 million**). Chainalysis also reported that while fewer victims paid, the average payment among those who did rose **368% YoY** to nearly **$60,000**, and assessed that ransomware operators continued to evolve extortion tactics to increase leverage and impact beyond direct cryptocurrency payments.
Jun 29, 2026