Vertex AI Vulnerability Exposes Google Cloud Data and Private Artifacts

Palo Alto Networks Unit 42 disclosed a security vulnerability in Google Cloud's Vertex AI platform where AI agents could be weaponized to access sensitive data.

• •The Per-Project, Per-Product Service Agent (P4SA) associated with Vertex AI's Agent Development Kit (ADK) had excessive permissions granted by default
• •Any call to a deployed Vertex AI agent invokes Google's metadata service and exposes service agent credentials, GCP project info, agent identity, and machine scopes
• •Stolen credentials allowed researchers to jump from the AI agent's execution context into the customer project, granting unrestricted read access to all Google Cloud Storage buckets in that project
• •The same P4SA credentials also exposed access to restricted, Google-owned Artifact Registry repositories containing private container images core to Vertex AI Reasoning Engine