Critical Thinking - Bug Bounty Podcast · Justin Gardner (Rhynorater), Joseph Thacker (Rez0), & Brandyn Murtagh (gr3pme)

Episode 159: Avoiding Downgrades on Google Cloud VRP with Cote and Darby Hopkins

January 29, 2026·1 hr 47 min·1 clip

He found something that we hadn't been able to prove, showing how to impersonate a higher-privileged service account.

Brandon Grett discusses AI red teaming terminology with HackerOne experts Rezo and Luke Stevens, clarifying industry confusion. Guest Google Cloud VRP team members Darby Hopkins and Michael Cote explain the recent bug swat event with 160 reports and $1.6M in rewards. Jacob Damaraki's research on service account impersonation chains is highlighted as key breakthrough that enabled other researchers to succeed.

As heard by us

A practical bug bounty episode about cloud targets, report quality, and how rewards are decided.

The episode stays focused on the bug bounty details that matter most in practice: making reports easier to reproduce, understanding how cloud configuration shapes what researchers can test, and seeing how an unusual setup can change the reward path.

Read the full review in PlayNext →

Why you'd press play

Want the inside baseball on cloud bug bounty rewards and downgrades?

Read the full recommendation in PlayNext →

Listen to the show on

Apple Podcasts Spotify

Play clips from this episode More from Critical Thinking - Bug Bounty Podcast