Google Project Zero interviews

“So candidates apply to our job posting, and then go through a phone interview, and then five interviews on different topics if they are successful.”

“Typically a candidate can expect to encounter a mix of security focused and software engineering focused questions in the interviews.”

“Most people hired by Project Zero have a history of publicly reporting vulnerabilities in widely used software or participating in projects related to vulnerability research.”

“Reading code to find vulnerabilities is different from just reading code to understand how it works – the former requires purposeful adversarial thinking.”

“Unlike many reasoning-related tasks where verifying a solution can introduce ambiguities, vulnerability discovery tasks can be structured so that potential solutions can be verified automatically with absolute certainty.”

“Project Zero follows a 90+30 disclosure deadline policy, which means that a vendor has 90 days after Project Zero notifies them about a security vulnerability to make a patch available to users.”

“We believe this is the first public example of an AI agent finding a previously unknown exploitable memory-safety issue in widely used real-world software.”