Google wants you to find bugs in its AI tools, systems, to pay up to $30,000

Google has launched a new bug bounty programme focused entirely on artificial intelligence, expanding its long-running Vulnerability Reward Program to cover AI-specific threats. The company hopes the new incentives will help uncover “rogue actions” — AI-triggered exploits that can manipulate devices, leak data, or perform unintended tasks.

In a detailed breakdown, Google defines AI bugs as vulnerabilities that allow large language models or generative systems to cause harm or bypass security. That could include a poisoned prompt making Google Home unlock a door, or a malicious input that summarises someone’s email and sends it to an attacker’s account. The company cited past flaws such as a manipulated Google Calendar event that could remotely switch off lights or open smart shutters.

Simply making Gemini hallucinate doesn’t qualify. Google clarified that content-related issues — like generating hate speech or infringing material — should be reported through in-product feedback instead, allowing AI safety teams to retrain the models where needed.

Top-tier findings affecting Google Search, Gemini apps, Gmail, or Drive can earn researchers $20,000, with bonuses for report quality and originality pushing payouts up to $30,000. Lower rewards will apply to issues discovered in products like NotebookLM or the experimental Jules assistant.