Show HN: Hacking Google with AI for $500,000
Summary
Brutecat Security documents a security research project that used AI to fuzz Google APIs across hundreds of services, uncovering multiple critical findings and earning substantial bounties. The write-up details methodology, including API key collection, discovery documents, authentication tricks, origin whitelisting, and a move into GraphQL fuzzing, with notable payouts for issues across Google Cloud and YouTube-related services. The article highlights lessons on IAM, access controls, and the security surface of large cloud platforms.