Researcher Used AI to Find $500,000 in Google Bug Bounty Flaws

A security researcher used an AI-assisted testing pipeline to find more than $500,000 worth of vulnerabilities across Google services in less than three months. The work, detailed in a new Brutecat write-up, focused on broken access controls and exposed internal APIs rather than malware or a conventional network breach.

The researcher, Arvin Shivram of Brutecat Security, said the project examined about 1,500 Google APIs and used roughly 3,600 API keys during testing. The findings were reported through the Google Vulnerability Reward Program, which pays outside researchers for responsibly reported security issues.

The research is notable because it shows how AI can help scale API security testing when a human researcher still controls the workflow. The AI system did not replace manual review. It helped sort endpoints, test access-control assumptions, and flag suspicious responses for human confirmation.

Google API Testing Exposed Repeated Access-Control Problems

The campaign started with Google discovery documents. These are machine-readable API descriptions that list services, methods, parameters, and request formats. Some Google APIs publish these documents publicly, while others require valid keys or sit behind internal access controls.

Shivram and collaborator Michael Dalton gathered large numbers of API keys from mobile apps and web traffic, then filtered the results to stay within Google-owned infrastructure. The research then mapped internal and semi-internal APIs and tested whether endpoints enforced proper authorization before returning data or allowing changes.

Several findings involved the same broad weakness: APIs accepted requests without checking whether the caller had permission to read or modify the target resource. That pattern appeared across consumer services, Google Cloud products, media systems, advertising tools, and internal admin surfaces.

Area affected	Reported issue	Reported reward
Google Voice and Google Fiber	Account data exposure and unauthorized phone-number assignment	$20,000
AdExchange	Staging system connected to production data, with admin escalation	$30,000
Translation Hub	Cross-tenant read and write access, plus cloud storage exposure	$36,500
YouTube TV CMS	Unauthorized campaign management and leaked CMS account emails	$24,000
Vertex AI Search for Commerce	Unauthorized access to intent-classification configuration	$30,000
Cloud Console GraphQL	Unauthenticated access to sensitive service data in several GraphQL surfaces	Up to $30,000 per issue

AI Helped Prioritize the Most Suspicious API Responses

After mapping the API surface, the researcher built a custom testing system and connected it to Claude. The system gave the model a limited set of tools for probing APIs, reporting possible vulnerabilities, and marking tests as complete.

The research notes say the workflow improved after a month of tuning. The AI grouped similar endpoints, compared responses across multiple keys, and translated confusing Google API errors into clearer labels.

That mattered because many authorization bugs do not look obvious from a single response. A request may return data for one key, deny another key, and leak metadata for a third. The AI helped compare those patterns at scale, while the researcher still validated the results before submitting reports.

• The testing focused on broken access control and insecure direct object reference flaws.
• The AI helped classify endpoints and responses faster than manual review alone.
• Human review remained necessary before reports were submitted to Google.
• The research stayed within Google’s vulnerability disclosure process.

The Most Serious Finding Involved Google Voice and Fiber

One of the highest-impact findings involved a Google Voice and Google Fiber management API. According to the report, the API exposed personal information and allowed unauthorized phone-number changes when given a target Google account identifier.

The risk was serious because phone numbers can play a role in account recovery and identity verification. If abused, a flaw of that kind could support account-takeover or SIM-swap-style attack paths. Google reportedly rated the issue at its highest severity level and fixed it within hours.

Other findings were less direct but still important. Some APIs exposed internal privacy assessments, YouTube-related data, Widevine organization information, Translation Hub operations, Vertex AI Search for Commerce configuration, and Cloud Console GraphQL data.

Finding type	Why it matters
Missing authorization checks	Attackers may access or change resources they do not own.
Cross-tenant access	One customer or project may see data belonging to another.
Staging connected to production	Test environments may expose real user or business data.
GraphQL introspection and weak validation	Attackers may discover sensitive schemas or query data without proper checks.
Prompt and configuration control	Attackers may alter behavior in AI-powered customer-facing systems.

Google’s Bug Bounty Program Gives Context to the Payout

Google has run vulnerability reward programs for years, and the company says these programs help it receive reports from outside researchers before flaws can be exploited by malicious actors. The official program rules define scope, reporting expectations, and reward categories.

Google also created a dedicated Google Cloud Vulnerability Reward Program in 2024. The company said at the time that the cloud-specific program would give researchers clearer paths for reporting Google Cloud issues and more direct interaction with cloud security engineers.

Google’s 2025 VRP year in review shows the scale of the program. Google said it paid more than $17 million to over 700 researchers in 2025, marking an all-time high for its vulnerability rewards.

Why This Research Matters for API Security

The findings show that access-control bugs remain one of the hardest problems in large cloud and consumer platforms. Modern services often depend on thousands of APIs, internal tools, staging systems, identity layers, and machine-readable service definitions.

AI changes the economics of testing that surface. A researcher can use an AI system to process more endpoints, compare more responses, and spot patterns faster. That can help defenders, but it can also raise pressure on companies to harden APIs before attackers automate similar workflows.

The research also highlights why staging environments and internal APIs need the same security discipline as public products. If a test service can reach production data, a small access-control mistake can become a high-impact exposure.

• Companies should treat internal discovery documents as sensitive infrastructure maps.
• Every API endpoint should enforce authorization on the server side.
• Staging systems should not have unrestricted access to production data.
• GraphQL endpoints should restrict introspection and enforce per-object access checks.
• AI-assisted testing should support human review, not replace it.

Google Fixed Reported Issues Through Responsible Disclosure

All reported issues were submitted through Google’s vulnerability reward process. The public write-up does not claim that attackers exploited the bugs in the wild, and the findings should be understood as controlled security research.

The case still sends a clear message to enterprise security teams. API inventories, access-control tests, and authorization reviews need to scale as fast as the systems they protect. AI-assisted testing can help, but only when paired with strong scope controls, careful validation, and responsible reporting.

The latest Google Cloud VRP structure and Google’s latest VRP review show that large vendors expect outside researchers to keep playing a major role in finding complex flaws. Shivram’s research shows that the next wave of bug hunting will likely involve more AI-assisted workflows and much larger API coverage.

FAQ