Google reports more than $17 million in 2025 bug rewards

Google said on 31 March that it awarded more than $17 million to over 700 researchers through its vulnerability rewards programmes in 2025. The company described the amount as a record and more than 40% above 2024. Those are Google’s reported payouts across multiple programmes.

Its review highlighted a dedicated AI rewards programme and AI-feature categories within Chrome’s programme. It also described patch rewards for improvements to OSV-SCALIBR, a dependency and secret-scanning tool. Payouts measure accepted reports and programme decisions; they do not directly measure how safe one product is compared with another. Researchers still need to check the relevant programme’s scope and reporting terms rather than assuming every AI behaviour qualifies for a reward.