Hacking Google with A.I. for $500,000

by

Author: Arvin Shivram (brutecat)
Published: June 11, 2026
Source: https://brutecat.com/articles/hacking-google-with-ai/

Summary

Security researcher brutecat (Arvin Shivram) documents a large-scale campaign that used an LLM-driven fuzzing pipeline to systematically probe roughly 1,500 of Google’s internal and external APIs with about 3,600 collected API keys, uncovering a series of access-control, authentication, and data-exposure flaws that earned a reported $500,000 across 20+ distinct Google VRP (Vulnerability Reward Program) submissions. The findings were reported to Google, triaged through its VRP, and patched — several P0/S0 issues within hours — so this is a coordinated-disclosure writeup of fixed bugs rather than a live 0-day drop. One issue, an App Engine request-log exposure, was assigned CVE-2026-8934; the remaining findings are tracked as VRP reports without individual CVEs. The article’s stated theme is what happens when an AI agent is pointed at a very large, uniform API surface.

Technical Details

The methodology combined classic recon with AI-driven testing. Recon: the author harvested API keys at scale (extracting tens of thousands of Google Android APKs from mirror sites, intercepting traffic across 2,800+ Google domains with a Chrome Debugger extension, and analyzing decrypted iOS binaries), then filtered to Google-owned keys via a Cloud Marketplace ownership check. Google’s machine-readable API “discovery documents” (many formerly reachable at /$discovery/rest, a path Google removed from most APIs in July 2025) were enumerated using certificate-transparency logs and keyword brute-forcing, with hidden endpoints surfaced by requesting internal visibility labels (e.g. GOOGLE_INTERNAL).

To reach first-party-only endpoints, the author reverse-engineered Google’s First-Party Auth (FPA) token scheme from leaked source maps and dealt with per-API guardrails: origin allow-listing (gaia_mint.AllowedFirstPartyAuth, enforcement from MONITORING_ONLY to ENFORCE_ALL) and the four API-key restriction types (server/IP, browser/Referer, iOS bundle-ID, Android package+cert; the server/IP form being the only unbypassable one). The AI layer classified endpoints into functional groups, fanned a single probe across all keys, grouped responses by hash to spot anomalies, parsed Google’s standardized error reasons into typed explanations to curb hallucination, and tied each reported finding to a replayable operation ID to prevent false positives. This summary deliberately omits the demonstration API keys and exact request payloads reproduced in the original.

Impact

The campaign found a broad set of missing-authorization and cross-tenant flaws, most of which stemmed from staging/sandbox environments mirroring production data without authorization checks, or backend endpoints left reachable despite a protected frontend. Highlights as reported (with VRP awards):

  • Google Voice account takeover ($20k) — BssGetVoiceSettings with no access control leaked a victim’s Voice/recovery number and allowed assigning arbitrary numbers by Gaia ID.
  • AdExchange (Ad Manager) ATO ($30k combined) — a staging buyer API let an attacker enumerate accounts and add themselves as admin.
  • Eldar internal privacy-assessment system ($26,674 combined) — public backend exposed internal access requests and Googler emails.
  • YouTube unlisted-video disclosure ($12k) — Content ID auto-generated asset names leaked unlisted/private video IDs, with insider-trading potential on announcement timing.
  • Widevine DRM ATO ($16,004.40) — enumerate organizations, retrieve/decode DRM signing keys, and add users to any org.
  • PLX / DataHub analytics ($12k ×2) — staging with production data allowed unauthorized setIamPolicy and access to petabyte-scale YouTube analytics tables and internal SQL.
  • Nest owner deanonymization — sequential device/Gaia-ID walking resolved to owner emails, enabling bulk deanonymization.
  • Vertex AI Translation Hub ($36,500 combined) — unauthenticated ListOperations and cross-tenant reads/writes exposing service accounts, GCS paths, translator PII, and a GCS-exfil oracle.
  • YouTube TV/Film CMS ($24k) — unrestricted list/read/modify/clone/delete of any campaign, plus CMS account emails.
  • Vertex AI Search for Commerce ($30k) — cross-tenant read/write of conversational-search config enabling prompt injection into customer-facing AI and policy tampering.
  • Cloud Console GraphQL — a staging variant skipped query-signature validation for unauthenticated requests, opening introspection and further queries.
  • App Engine request logs (CVE-2026-8934) ($18k) — the GetDashboardAppStats GraphQL query on cloudconsole-pa.googleapis.com returned any project’s last 24h of App Engine request logs with no IAM check and no authentication; classified by Google as “Single-Service Privilege Escalation – READ.”
  • Vertex Assistant — an AgentListSessions GraphQL query lacked authentication, letting an attacker read a victim’s data. The article also includes a Google Maps Platform billing-credits finding.

Collectively the impact ranges from account takeover and cross-tenant data exposure to leakage of DRM keys, private video IDs, and internal Google metadata and personnel information.

Mitigation

All issues were reported through Google’s VRP and remediated by Google — P0/S0 findings (e.g. Google Voice) reportedly patched within hours, and Google had already removed the /$discovery/rest path from most APIs in July 2025. There is no user-side patch to apply; the article carries no vendor-published advisory beyond CVE-2026-8934. The transferable lessons for defenders: enforce authorization on every endpoint including backend/staging/sandbox variants (never rely on frontend gating), avoid populating non-production environments with production data absent equivalent access controls, treat sequential/guessable object IDs as an enumeration risk, validate IAM on GraphQL resolvers, and remember that machine-readable API specs plus uniform structure make an entire surface cheaply fuzzable — including by an AI agent.

References

Leave a Comment