March 26th, 2026 submissions closed May 8th, 2026. Google's official threat release on May 11th, 2026 has multiple issues described almost word for word as my March 26th, 2026 VRP submissions. Plus, I used the exploit to document
bug-bounty sandbox-escape ai-security metadata-proxy security-report prompt-injection llm-safety google-vrp p1-verification stt-bypass jwt-exfiltration researcher-ripped-off vrp-fraud-proof
-
Updated
May 20, 2026