Researchers Show How Vertex AI Agents Could Be Abused; Google Updates Guidance

Summary

Palo Alto Networks researchers described ways excessive Vertex AI service-agent permissions could expose project resources and enable backdoors. Google revised its documentation and recommends BYOSA for least-privilege execution.

Key points

Palo Alto Networks researchers examined agents built with Vertex Agent Engine and the Agent Development Kit.
They found that excessive default P4SA permissions could expose service-agent credentials and allow access from an agent’s execution context to the owner’s project and associated storage.
Researchers said compromised credentials could provide access to private container images, restricted Artifact Registry repositories, and Cloud Storage buckets.
They described a file that an attacker might manipulate to achieve remote code execution in an agent environment and establish a persistent backdoor.
Google revised its documentation to highlight potential risks and recommends Bring Your Own Service Account (BYOSA) to enforce least-privilege permissions.
Google said non-overridable controls prevent service agents from altering production images.

Article Details

Event Type: Security research disclosure about excessive default permissions and abuse paths in Google Vertex AI Agent Engine.
Impact: Palo Alto Networks researchers demonstrated that compromised service-agent credentials could enable access from an AI agent’s execution context to the owner’s Google Cloud project, private container images, restricted Artifact Registry repositories, and Cloud Storage buckets. They also described a file that could potentially be manipulated for remote code execution and a persistent backdoor. The article reports research demonstrations and potential risks, not confirmed exploitation in the wild. Google revised its documentation and recommends Bring Your Own Service Account with least-privilege permissions.

MITRE ATT&CK

T1078.004 · Cloud AccountsResearchers described how an attacker could abuse compromised Google Cloud service-agent credentials to access the associated project.T1530 · Data from Cloud StorageResearchers described potential access to Google Cloud Storage buckets containing potentially sensitive information.

Vendors

GooglePalo Alto Networks has shared details about how its researchers weaponized AI agents built on Google Cloud’s Vertex AI development platform.

Products

Agent Development Kit (ADK)The research focused on the Vertex Agent Engine and the Agent Development Kit (ADK), which enable developers to create, deploy, manage, and scale AI agents.Google Artifact RegistryThey also found that the compromised credentials could be used to access restricted Artifact Registry repositories containing other images that could be useful to attackers, as well as Google Cloud Storage buckets Google Cloud PlatformA service agent is a service account that enables Google Cloud Platform (GCP) services to access resources.Google Cloud StorageRegistry repositories containing other images that could be useful to attackers, as well as Google Cloud Storage buckets containing potentially sensitive information.Vertex Agent EngineThe research focused on the Vertex Agent Engine and the Agent Development Kit (ADK), which enable developers to create, deploy, manage, and scale AI agents.Vertex AIPalo Alto Networks has shared details about how its researchers weaponized AI agents built on Google Cloud’s Vertex AI development platform.