How I Used AI to Earn $500K in Google Bug Bounty in Three Months

In 2025 the author wondered whether an AI could help discover bugs in Google’s vast API ecosystem, despite the common belief that Google’s Vulnerability Reward Program (VRP) leaves little room for new findings.

Day 1 – Collecting "keys" : The author harvested API keys from three sources – Google’s public API Explorer, YouTube videos and blog posts that unintentionally leaked internal domains, and GitHub code samples that contained real keys. After months of crawling, a large pool of keys covering many internal services was assembled.

First week – Mapping the "doors" : Using the collected keys, a scanner searched Google’s domains for Discovery JSON documents that describe API endpoints, parameters, and authentication requirements. The scanner uncovered many undocumented APIs, revealing that Google’s internal APIs often have far weaker security controls than public ones.

First month – Cracking authentication : Google APIs use the FPA v2 mechanism, where an API key identifies the project and an FPA token identifies the user. The author discovered varied authentication requirements across APIs and bypassed them by exploiting lax domain checks (e.g., using google.com.evil.com) and overly permissive test‑environment validations.

Second month – Building a "master key" tool : An automation framework was created to generate test requests from Discovery docs, perform multi‑dimensional testing (different auth states and parameter combos), compare responses, and flag potential vulnerabilities. The tool could not reliably judge whether an anomaly was a true bug, prompting the integration of AI.

AI deployment : The initial AI workflow used two functions – probe_api (to test an endpoint) and report_vulnerability (to log findings). The AI often stopped after shallow checks, so a "Ralph Wiggum" loop forced it to probe each endpoint at least once. Accuracy remained low until the author regrouped endpoints by functionality, simplified probe_api calls (e.g., shortening

autopush_cloudcrmcards_pa_sandbox.updateDataFetcherConfiguration

to updateDataFetcherConfiguration), and tested each endpoint with all known keys, dramatically improving detection of "visibility‑label"‑restricted endpoints. Error responses were parsed into standardized codes such as MISSING_REQUIRED_VISIBILITY_LABEL, and system prompts were refined to suppress noisy reports (e.g., ignoring 500, 401/403/404 unless they leaked extra data). After a month of prompt tuning, AI accuracy exceeded 50% – roughly one real bug per two reports.

Key discoveries :

Google Voice account takeover: a single curl request to gfibervoice-pa.googleapis.com with a leaked API key exposed personal phone numbers, recovery numbers, voicemail settings, and call‑forwarding numbers. Rated P0/S0, earning $20,000.

AdExchange sandbox exposing production data: the test domain test-adexchangebuyer-googleapis.sandbox.google.com listed all accounts and allowed admin addition, yielding $30,000.

Eldar internal privacy system: the endpoint eldar-pa.clients6.google.com revealed employee privacy request logs, granting $26,674.

YouTube unlisted video assets: assets named Auto generated asset - <video_id> could be enumerated to discover unpublished videos, worth $12,000.

Widevine DRM key management portal: accessible with a Google account, it listed partner organizations, exposed AES keys, and allowed admin addition, resulting in $16,004.40.

Methodology recap :

Internal APIs are a gold mine – they often lack the hardened security of public APIs.

Boundary cases are breakpoints – source verification, key limits, and visibility tags hide many flaws.

Systematic tooling is essential – a robust pipeline of collection, scanning, AI‑assisted testing, and reporting enables sustained high‑value output.

In total, the three‑month effort generated over $500,000 in bug‑bounty rewards. The author concludes that AI‑assisted penetration testing dramatically reduces manual effort, and the next target remains undecided, signaling the early stage of this emerging approach.