A security researcher known as Arvin Shivram has disclosed one of the most sophisticated and lucrative vulnerability research campaigns ever carried out against Google, earning a staggering $500,000 in bug bounty rewards in under three months by combining AI-powered fuzzing with deep API reconnaissance.
The research began after Brutecat was invited to Google’s bugSWAT Mexico event in October 2025, which reignited interest in Google’s API attack surface.
The key insight was leveraging Google’s discovery documents machine-readable API specifications, similar to Swagger docs, which expose all available endpoints, parameters, and HTTP methods for both public and internal Google APIs.
Access to these documents required valid API keys. The researcher and a collaborator scraped over 60,000 Android APKs, every version of every Google app ever released, and used a custom Chrome extension to intercept live network traffic across 2,800+ Google web domains, amassing a comprehensive collection of API keys.
Certificate transparency logs and brute-force domain generation were used to identify live Google API services by checking server response headers such as ESF and GSE .
After Google removed the standard /$discovery/rest path from most APIs in July 2025, the researcher discovered that appending visibility label parameters like ?labels=GOOGLE_INTERNAL could unlock hidden endpoints in discovery documents, expanding some from 253KB to 329KB of previously invisible API definitions. This ultimately yielded discovery documents for 1,500+ APIs.
With APIs mapped and authentication solved using Google’s leaked First-Party Authentication (FPA) v2 library source code, the researcher built a custom API Explorer and wired it up to Claude AI as an MCP (Model Context Protocol) agent.
The AI was given tools probe_api, report_vulnerability, and confirm_testing_complete to autonomously fuzz each API group, testing for IDOR and broken access control vulnerabilities.
Early runs produced too much noise. The researcher refined the system prompt over a month, training the AI to ignore false positives, such as existence enumeration, and to report only confirmed data exposures.
Once tuned, the AI’s accuracy exceeded 50%, with findings verified by replaying logged request/response pairs directly from the frontend.
The most severe finding was a complete lack of access controls on gfibervoice-pa.googleapis.com, the backend for Google Voice and Google Fiber.
Brutecat stated that a single unauthenticated curl request using only a public API key and a victim’s unobfuscated Gaia ID could dump full PII, including Google Voice numbers and account recovery phone numbers.
Worse, the API allowed an attacker to silently assign a phone number to any victim’s Google account, which appeared under myaccount.google.com/phone opening the door to potential SIM swap attacks.
The bug was rated P0/S0 (highest severity), patched within hours, and awarded $20,000 on its own.
| Vulnerability | Affected API / Service | Vulnerability Type | Bounty |
|---|---|---|---|
Google Voice ATO No access controls; unauthenticated curl request exposed victim PII (Google Voice number, recovery phone), plus silent phone number assignment to any account | gfibervoice-pa.googleapis.com | Broken Access Control / Missing Auth Checks | $20,000 |
| IDOR via Internal People API Gaia ID to Email mapping disclosure, exposing victim email address | Internal People API | IDOR / PII Exposure | ~$6,000–$9,000 |
Support Content/Workflow Access Control Bug API only allowed *.corp.google.com origins (internal API exposed publicly); access control vulnerability on content management workflows | contentmanager.clients6.google.com | Broken Access Control | $9,000 |
Assigned TAMs Data Leak IDOR exposing assignedTams (Technology Account Managers) linked to victim accounts | Internal Google API (Demo endpoint) | IDOR / Data Exposure | $6,000 |
Discovery Document Hidden Endpoint Exposure ?labels=GOOGLE_INTERNAL parameter unlocks hidden API endpoints (253KB → 329KB), revealing undocumented internal methods | serviceusage.googleapis.com and 1,500+ APIs | Information Disclosure / Improper Access Control | Part of the cumulative bounty |
FPA v2 Source Code Leak via Android Review Sourcemaps Google accidentally leaked internal gapix library source code on android-review.googlesource.com, enabling attackers to forge valid First Party Auth v2 headers | android-review.googlesource.com | Sensitive Information Disclosure | Part of cumulative bounty |
| Cloud Marketplace Project Enumeration API reveals GCP project ownership (company domain) from a project number, enabling attacker to enumerate and verify Google-owned API keys | cloudmarketplace.clients6.google.com | Information Disclosure / Recon Amplification | Part of the cumulative bounty |
zHandler Intranet Exposure (/btz) Internal Borg debug endpoints (zhandlers) accessible publicly after Google Voice API takedown; leaks internal debug info normally intranet-only | gfibervoice-pa.googleapis.com | Exposed Internal Debug Interface | Part of the cumulative bounty |
| Multiple IDOR/Broken Access Control Bugs across 1,500+ APIs (AI-discovered, dozens of additional findings) | Various Google internal APIs | IDOR / Broken Access Control | $500,000 total (cumulative) |
Throughout the campaign, the AI-assisted research uncovered dozens of access-control bugs in Google’s internal API ecosystem.
Individual bugs ranged from $6,000 to $20,000, for a total of $500,000, making it one of the highest single-researcher payouts in Google VRP history.
This research demonstrates a paradigm shift in vulnerability discovery: AI agents, when properly constrained by smart tooling and precise prompts, can autonomously identify high-severity security flaws at a scale that no individual researcher could achieve manually.
The combination of systematic API enumeration, authentication bypass techniques, and AI-driven fuzzing represents a new frontier in offensive security research.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
