Google revealed it paid over $17 million to 747 security researchers last year through its Vulnerability Reward Program (VRP) — the highest payout since the program launched in 2010.
Since its launch, Google has awarded more than $81.6 million in bug bounties to researchers who identify and responsibly disclose vulnerabilities in Google products and services.
Key highlights from 2025
• 🧠 Launch of a new AI Vulnerability Reward Program targeting security flaws in AI systems
• 🌐 Chrome VRP expanded to include AI-related bug categories
• ☁️ Cloud VRP first full year: $3.57M awarded to 143 researchers
• 📱 Android & Devices program: $2.9M in rewards
• 🌍 Chrome security program: $3.7M paid to over 100 researchers
• 💰 Largest single bounty: $250,000
Bug bounty programs like Google’s VRP demonstrate the power of collaborating with the global security research community. Instead of hiding vulnerabilities, responsible disclosure programs encourage researchers to report them — strengthening the security of platforms used by billions of people.
As technologies such as AI and cloud infrastructure evolve, these programs are becoming increasingly critical for staying ahead of emerging threats.
👏 A huge thanks to the global bug hunter community for helping make the internet safer.
