Google is now paying bug bounties for generative AI flaws

If you can trick an AI model into going off the rails or hallucinating sensitive data, Google might now cut you a check.

Google officially expanded its Vulnerability Rewards Program to cover attack scenarios specifically targeting generative AI. Alongside the new bounties, the company is rolling out security tools designed to stop hackers from tampering with open source AI models.

Hunting hallucinations for cash

Traditional bugs are pretty black and white, like a memory leak or an authentication bypass. Generative AI is a different beast altogether, introducing wild new issues like model manipulation, severe bias, and dangerous hallucinations.

To help bounty hunters know where to aim, Google published a fresh set of reporting guidelines defining what kind of AI exploits are officially in scope.

This follows August's massive red-teaming event at DEF CON, where Google joined the White House and other tech giants to let thousands of independent hackers stress-test LLMs. Google clearly realized that internal Trust and Safety teams cannot find every weird prompt injection on their own, so they are turning bug hunting into an open competition.

A digital tamper seal for weights

Bounties cover the front door, but Google is also trying to lock the back door: the AI supply chain.

Right now, developers download pre-trained weights from open source hubs with almost zero verification. If an attacker tampers with a checkpoint or poisons training data, teams rarely know until things break in production.

Google's Open Source Security Team is tackling this using its Secure AI Framework alongside the Open Source Security Foundation. They launched prototypes that pair Sigstore for digital model signing with SLSA for verifying build attestations. Basically, it acts like a cryptographic tamper-evident seal for open source AI checkpoints.

Why it matters

For security researchers, jailbreaking models is no longer just a Twitter parlor trick; it is now a legit, billable attack vector. If you know how to bypass safety guardrails or inject prompts, you now have a direct pipeline to vendor payouts.

For the broader industry, Google's push to secure model weights is long overdue. While the AI world has moved at breakneck speed, its supply chain hygiene has been embarrassingly primitive compared to standard software development. Bringing tools like Sigstore to model weights sets a healthy precedent that rivals will have to match.

Still, measuring these bugs will be a headache. Unlike hard software crashes, determining where a subjective hallucination ends and a security vulnerability begins is messy. But it signals an important shift: tech giants are finally admitting that models are software, and they need software-grade security guardrails.