Hacking Google with A.I. For $500k
type: NewsArticle
description: A security researcher earned $500,000 from Google's Vulnerability Reward Program after using AI to automatically fuzz Google's internal APIs at scale. The researcher collected over 60,000 API keys from Google apps and services, then leveraged Google's discovery documents to systematically probe for vulnerabilities across the company's attack surface.
date published: 2026-06-11T21:39:20+00:00
date modified: 2026-06-11T21:49:29+00:00
language: en
is accessible for free: true
article body: After being invited to [bugSWAT Mexico](https://x.com/brutecat/status/1974906110579745274) in October 2025, I found myself drawn back to Google research. While I'd been focused on other projects for several months, the team's willingness to give researchers a peek into Google's source code reignited my interest in exploring Google's attack surface. Having spent the past year building small projects with Claude, I realized there was untapped potential in using AI to automatically fuzz Google's APIs at scale. The key to this approach? Google's discovery documents. For those unfamiliar, I'd recommend reading [my other article](/articles/decoding-google) for a deep dive, but here's a quick refresher: Discovery documents are essentially Google's equivalent of Swagger docs - machine-readable API specifications that list all available endpoints, parameters, and methods. While they're publicly documented for APIs like the [YouTube Data API](https://developers.google.com/youtube/v3), they also exist for Google's internal APIs (like the Internal People API). Some discovery docs are [publicly accessible](https://people-pa.googleapis.com/$discovery/rest), while most [require valid API keys](https://protos.googleapis.com/$discovery/rest). Here's an example from the YouTube Data API's discovery document: ``` ... "liveChatModerators": { "methods": { "insert": { "flatPath": "youtube/v3/liveChat/moderators", "description": "Inserts a new resource into this collection.", "httpMethod": "POST", "parameters": { "part": { "description": "The *part* parameter serves two purposes in this operation. It identifies the properties that the write operation will set as well as the properties that the API response returns. Set the parameter value to snippet.", "repeated": true, "required": true, "location": "query", "type": "string" } ... ``` [#](#collecting-api-keys)Collecting API Keys To access most discovery documents, you need a valid API key. API keys are embedded in virtually every Google a…
publisher: Web Pulse
keywords: artificial-intelligence, ai-tools, ai-research
mentions: Google
mentions: bugSWAT Mexico
mentions: Claude
mentions: YouTube Data API
mentions: Internal People API
citation: CreativeWork