Vertex AI flaw let agent credentials expose Google Cloud data and private artifacts

Palo Alto Networks Unit 42 disclosed a weakness in Google Cloud Vertex AI that could let attacker-controlled AI agents extract credentials from the platform’s Per-Project, Per-Product Service Agent (P4SA) and use them to access customer resources. The issue affects deployments built with the Agent Development Kit through Agent Engine, where excessive default permissions weakened isolation between the AI agent runtime and the customer’s Google Cloud project. Researchers said exposed service-agent credentials could be abused to gain broad read access to Google Cloud Storage data and to view restricted Google-owned Artifact Registry repositories linked to Vertex AI infrastructure.

Unit 42 said the flaw also exposed details about internal Google infrastructure and potentially proprietary code associated with the Vertex AI Reasoning Engine. Researchers further warned that insecure Python pickle usage and broad, non-editable OAuth 2.0 scopes could expand the blast radius beyond GCP into Google Workspace services such as Gmail, Google Calendar, and Google Drive. Google responded by updating its guidance and urging customers to adopt Bring Your Own Service Account (BYOSA) and least-privilege controls to reduce the risk.