Google AI Vulnerability Reward Program

What this programme is

A vulnerability reward programme (VRP), also called a bug bounty, is a scheme where a company invites outside researchers to find and report security flaws in listed products, under published rules, and pays for valid reports. Google has run VRPs for years. In October 2025 it launched a dedicated AI VRP for its AI products, which until then had been handled inside its abuse programme. Google said the move came with clearer rules on scope and rewards.

What is in scope

The rules focus on flaws with real security impact, for example:

• Rogue actions: getting an AI feature to change a victim's account or data without their consent, such as an indirect prompt injection that makes an assistant act on the user's behalf. These receive the highest rewards.
• Sensitive data exfiltration: making an AI product leak a user's private data to an attacker.
• Others such as phishing enablement, model theft and denial of service against AI features.

Products are grouped into tiers, with flagship products in the top tier.

What is out of scope

Google states that jailbreaks, direct prompt injections and alignment or content issues are not rewarded through the VRP. Its reasoning is that content problems need long-term work across many reports rather than one-off payments. It still asks people to report them through in-product feedback.

This distinction is the most useful lesson for a beginner: an AI security bug is one where an attacker gains something, such as data or an action on someone else's account, not a model saying something it should not.

Is it worth your time?

Read the rules even if you never submit a report. They are a clear, real-world definition of AI security impact from a major vendor, and they show how scope, rules of engagement and impact are written. If you do take part later, follow the rules exactly, test only with your own accounts, and never touch other users' data.

Other AI companies run bug bounty programmes too, often on platforms such as HackerOne or Bugcrowd, each with its own scope. Always read the specific programme's current rules before testing.

Free or paid?

Free to take part. Reward amounts are set out in the official rules and can change, so check them there.