Google Cloud has introduced a new $250,000 "Root-in-Cloud" tier for its Vulnerability Reward Program (VRP) to incentivize high-impact architectural security research. This tier targets complex vulnerabilities like tenant-isolation bypasses and cross-service logic flaws, requiring deep human intuition and agentic tools. To achieve this reward, researchers must demonstrate full administrative control over arbitrary Google Cloud organizations or projects without prior access or leaked credentials. The program also specifies clear cryptographic validation for testing, ensuring safety and reproducibility. Additionally, remote code execution in Google's production infrastructure (Borg) will be evaluated for Root-in-Cloud eligibility, with strict rules against further exploitation. The new tier reflects the evolving security research landscape, where automated tools have increased report volume but human ingenuity remains crucial for significant findings. Chris Betz, CISO, and Michael Cote, VRP lead, discussed these changes at the Escal8 conference. Cote noted that while automation democratizes vulnerability discovery, it also pressures researchers to find more impactful bugs and accelerates exploit development for n-day vulnerabilities. Google emphasizes responsible disclosure policies to protect users, despite competitive pressures to publish quickly. Enterprise CISOs are advised to prepare for agent-generated submissions, compress remediation timelines, and demand coordinated disclosure from security partners.