Security researchers from XM Cyber have disclosed that default configurations in Google Vertex AI can allow low-privileged users to escalate privileges, potentially leading to remote code execution (RCE) and access to sensitive cloud resources.
🔍 What’s the issue?
Vertex AI attaches Service Agent accounts to instances for internal operations. These managed identities often receive broad project permissions by default, which attackers can abuse via confused deputy attacks.
Attack paths identified
🟦 Vertex AI Agent Engine
- Attackers upload malicious tools (e.g. a fake currency converter with a reverse shell)
- Code executes on the reasoning engine
- Metadata access reveals Service Agent tokens
- Results in access to LLM data, chats, logs, and Cloud Storage
🟦 Ray on Vertex AI
- Viewer-level users can access the Head Node Interactive Shell
- Grants root shell access on the cluster
- Attackers extract Custom Code Service Agent tokens
- Enables read/write access to GCS and BigQuery
⚠️ Google has classified these behaviors as “working as intended”, placing responsibility on customers to harden deployments.
Recommended mitigations
✔ Remove unnecessary Service Agent permissions
✔ Replace default roles with custom IAM roles
✔ Disable head node interactive shells
✔ Validate and restrict AI agent tool updates
✔ Monitor metadata access via Security Command Center
✔ Regularly audit reasoning engines and persistent resources
📌 Key takeaway:
When adopting managed AI platforms, default ≠ secure. Service Agents must be treated as high-value identities, not background plumbing.
