- Google paid 40% more in 2025 than 2024 to security researchers
- New AI vulnerabilities are being considered as threats emerge
- Major events accounted for around 20% of payouts
Google paid out $17.1 million in bug bounties in 2025, the most it has ever paid out in any single year, marking a 40% increase over the $11.8 million sum it coughed up in 2024.
However, despite such a sharp rise in cash value, the company only paid 13% more researchers (a total of 747 in 2025), suggesting vulnerability-spotting is becoming far more lucrative.
The company also boasted that it's paid out $81.6 million in VRP payouts since the scheme was launched in 2010.
Google's VRP is becoming more lucrative
Some of the most significant product areas included Android and Google Devices ($2.9 million), Chrome ($3.7 million) and Google Cloud ($3.57 million).
Google also launched its dedicated AI VRP last year to focus on risks like prompt injection, data exfiltration and rogue behavior – that one has paid out $350,000, bringing the total AI-related payouts to $890,000. To recognize the potential risks around AI, the company also added new reward categories for AI-related vulnerabilities in Chrome.
The AI VRP only launched in October 2025, with Google "recognizing that securing Generative AI Products requires specialized research distinct from traditional vulnerabilities." A single AI bugSWAT event rose 70 valid reports, totalling $400,000 in payouts.
Other events held in Sunnyvale, Las Vegas and Mexico City generated nearly $3 million in payouts, accounting for around 20% of the total bounties paid in 2025, making these events must-go-to destinations for security researchers.
"Our goal remains to stay ahead of emerging threats, adapt to evolving technologies, and continue to strengthen the security posture of Google’s products and services," the company wrote in a blog post, thanking those who have helped secure its products so far.
