Critical Google Cloud Vertex AI flaw exposes customer data

Key Takeaways

• A critical vulnerability was discovered in Google Cloud’s Vertex AI Agent Engine.
• The flaw, stemming from overly permissive default settings, could allow attackers to exfiltrate customer data and compromise cloud infrastructure.
• Affected entities are Google Cloud users deploying AI agents via Vertex AI.
• Google has addressed the issue and recommends users adopt a “Bring Your Own Service Account” (BYOSA) approach for enhanced security.

Critical Flaw in Google Cloud Vertex AI Exposes Customer Data

The increasing integration of artificial intelligence agents into enterprise operations, while boosting efficiency, simultaneously expands the digital attack surface. Recently, cybersecurity researchers identified a significant security vulnerability within Google Cloud Platform’s Vertex AI Agent Engine that could transform these AI tools into clandestine “double agents,” capable of sensitive data exfiltration and broader cloud infrastructure compromise.

Exploiting Default Permissions

The core of the problem lies in the excessively broad default permissions assigned to the Per-Project, Per-Product Service Agent (P4SA) linked to deployed AI agents. Researchers from Palo Alto Networks’ Unit 42 built a test agent using the Google Cloud Application Development Kit. They found it was straightforward to extract the underlying service agent credentials from this setup.

Once obtained, these stolen credentials could enable an attacker to bypass the AI agent’s isolated execution environment and penetrate the wider consumer project. This privilege escalation effectively turns a helpful AI assistant into a dangerous internal threat. A compromised identity would grant an attacker the ability to perform several malicious actions, including:

• Reading all data stored in consumer Google Cloud Storage buckets.
• Accessing restricted Google-owned Artifact Registry repositories.
• Downloading proprietary container images associated with the Vertex AI Reasoning Engine.
• Mapping internal software supply chains to uncover further vulnerabilities.

Beyond the consumer project, the compromised credentials also provided access to the Google-managed tenant project specifically dedicated to the agent instance. Within this environment, Palo Alto Networks researchers uncovered sensitive deployment files. These files contained references to internal storage buckets and, critically, a Python pickle file. The Python pickle module is known for its insecurity when deserializing untrusted data, presenting a potential avenue for an attacker to achieve remote code execution and establish a persistent backdoor if the file were manipulated successfully.

Further analysis revealed that the default OAuth 2.0 scopes allocated to the Agent Engine were dangerously permissive. Theoretically, these overly broad scopes could extend an attacker’s reach beyond the cloud environment, potentially into an organization’s Google Workspace applications. Although specific Identity and Access Management permissions prevented immediate exploitation in this scenario, the wide scopes represented a fundamental structural security weakness.

Enforcing Least Privilege

Following a responsible disclosure process, Google collaborated with the security researchers to mitigate these identified threats. Google confirmed that robust controls are in place to prevent attackers from modifying production base images, thereby blocking potential cross-tenant supply chain attacks. The company also updated its official Vertex AI documentation to provide greater transparency regarding resource and account usage.

To adequately secure Vertex Agent Engine deployments, organizations must move away from default configurations. Google now advocates for a “Bring Your Own Service Account” (BYOSA) approach. By substituting the default service agent with a custom account, security teams can rigorously enforce the principle of least privilege, ensuring that the AI agent is granted only the precise permissions necessary for its intended function.

What You Should Do

• Review all existing Vertex AI Agent Engine deployments to assess their current permission configurations.
• Immediately implement Google’s recommended “Bring Your Own Service Account” (BYOSA) approach for all new and existing AI agent deployments.
• Ensure custom service accounts are configured with the principle of least privilege, granting only the essential permissions required for agent functionality.
• Regularly audit service account permissions and access logs for any anomalous activity.
• Stay informed on Google Cloud security best practices and updates, particularly concerning AI and machine learning services.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.