Vertex AI Default Permissions Expose Cloud Data, Artifacts
Get the Tech newsletter
Daily tech — startups, AI labs, chips, the launches that shape the next decade. Free.
- Palo Alto Networks Unit 42 disclosed a security "blind spot" in Google Cloud's Vertex AI platform, finding that the Per-Project, Per-Product Service Agent (P4SA) has excessive default permissions that could turn a deployed AI agent into a "double agent" that exfiltrates data and creates backdoors.
- Unit 42 found that calls to a deployed Vertex AI agent invoke Google's metadata service, exposing service agent credentials, the host GCP project's identity, the agent's identity, and machine scopes — credentials that granted unrestricted read access to all Google Cloud Storage buckets within the customer project, undermining isolation guarantees.
- The same stolen P4SA credentials exposed restricted, Google-owned Artifact Registry repositories, allowing an attacker to download container images from private repositories that form the core of the Vertex AI Reasoning Engine, as well as several other restricted images.
- Unit 42 warned the exposed proprietary code reveals Google's intellectual property and gives attackers a blueprint to map Google's internal software supply chain, identify deprecated or vulnerable images, and plan further attacks.
- Google updated its official documentation to clarify how Vertex AI uses resources, accounts, and agents, and recommended that customers use Bring Your Own Service Account (BYOSA) to replace the default service agent and enforce the principle of least privilege.
- Unit 42 researcher Ofir Shaty said "granting agents broad permissions by default violates the principle of least privilege and is a dangerous security flaw by design," urging organizations to treat AI agent deployment with the same rigor as new production code.
Why it matters: Organizations running AI agents on Vertex AI should replace the default P4SA service agent with a custom, least-privilege account — Unit 42 demonstrated that default permissions granted full read access to project storage and visibility into Google's proprietary Artifact Registry images. Any agent deployed under the old defaults remains exposed until reconfigured with scoped credentials.
