TLDR Tech / InfoSec
Hacking Google with AI for $500,000
A security researcher targeted Google's internal and public APIs using automated key collection, discovery document scraping, and a custom API explorer wired into an AI-driven fuzzer. They harvested thousands of valid Google API keys from apps, web traffic, and binaries, then mapped which keys unlocked more than 1,500 APIs with different visibility labels and restrictions. By replaying and clustering multi-key probes, parsing Google's standardized error patterns, and layering in strong authentication support, the system reliably surfaced real access control bugs, including internal-only endpoints leaking sensitive account, content, and configuration data, which translated into over $500,000 in bounties.
Read the full story