Double Agents: Exposing Security Blind Spots in GCP Vertex AI
Summary: Unit 42 researchers deployed an AI agent on GCP Vertex AI Agent Engine and found its default Per-Project, Per-Product Service Agent (P4SA) carried excessive permissions, letting them extract that service agent's credentials and pivot into the consumer project with unrestricted read access to all Cloud Storage buckets. The same stolen credentials reached Google's producer-side restricted Artifact Registry repositories, including container images for the Vertex AI Reasoning Engine, and tenant-project buckets holding deployment details such as a Dockerfile.zip referencing internal buckets and a code.pkl pickle file.
Key Takeaway: A single compromised service agent was enough to break isolation between a customer's project and Google's own infrastructure, and the default OAuth scopes on Agent Engine extend as far as Gmail, Calendar and Drive - Google's suggested fix is Bring Your Own Service Account, which puts the least-privilege decision on you.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Cloud Security
- Related
- Google Cloud Warns Three AMD Turin CPU Flaws Could Leak Data Across Processes in VMs Cyber Risks · Nov 12, 2026New Falcon Cloud Security Innovations Secure the Cloud AI Runs On Cyber Risks · Nov 04, 2026