There are strings attached. To qualify, the exploit path must not rely on pre-existing access to a project, previously compromised credentials, or user interaction or social engineering. And because code execution in Borg could affect service availability or other customers' data, Google Cloud CISO Chris Betz said researchers must stop probing immediately upon achieving any execution there; escalation, credential extraction and lateral movement mean disqualification.

To keep testing safe, the program's lead Michael Cote said Google built a deterministic proof-of-root mechanism using a designated service account, letting researchers cryptographically prove unauthorised access against that identity rather than touching real customer projects. Cote also noted that first-time researchers combining their own intuition with agentic AI tools are finding more interesting bugs on average than novices did two years ago, though reaching the new tier requires deep architectural understanding.