{"id":9962,"date":"2026-01-18T10:03:40","date_gmt":"2026-01-18T10:03:40","guid":{"rendered":"https:\/\/serisec.com\/index.php\/2026\/01\/18\/googles-vertex-ai-vulnerability-enables-low-privileged-users-to-gain-service-agent-roles\/"},"modified":"2026-01-18T10:03:40","modified_gmt":"2026-01-18T10:03:40","slug":"googles-vertex-ai-vulnerability-enables-low-privileged-users-to-gain-service-agent-roles","status":"publish","type":"post","link":"https:\/\/serisec.com\/index.php\/2026\/01\/18\/googles-vertex-ai-vulnerability-enables-low-privileged-users-to-gain-service-agent-roles\/","title":{"rendered":"Google\u2019s Vertex AI Vulnerability Enables Low-Privileged Users to Gain Service Agent Roles"},"content":{"rendered":"

Google\u2019s Vertex AI Vulnerability Enables Low-Privileged Users to Gain Service Agent Roles
\n \t

\n
<\/BR>
\n
\n \t

\n
<\/BR><\/p>\n

\n

Google\u2019s Vertex AI contains default configurations that allow low-privileged users to escalate privileges by hijacking Service Agent roles.<\/p>\n

XM Cyber researchers identified two attack vectors in the Vertex AI Agent Engine and Ray on Vertex AI, which Google deemed \u201cworking as intended.<\/p>\n

Service Agents are managed identities that Google Cloud attaches to Vertex AI instances for internal operations. These accounts receive broad project permissions by default, creating risks when low-privileged users access them.<\/p>\n

Attackers exploit this through confused deputy scenarios, where minimal access grants remote code execution (RCE) and allows credential theft from instance metadata.<\/p>\n

Both paths start with read-only permissions but end with high-privilege actions, such as accessing Cloud Storage<\/a> (GCS) or BigQuery. The diagram illustrates the Ray on Vertex AI flow, from persistent resources access to the Custom Code Service Agent compromise.<\/p>\n

\n
\"Google\u2019s<\/figure>\n<\/div>\n
\n\n\n\n\n\n\n\n\n
Feature<\/th>\nVertex AI Agent Engine<\/th>\nRay on Vertex AI<\/th>\n<\/tr>\n<\/thead>\n
Primary Target<\/td>\nReasoning Engine Service Agent<\/td>\nCustom Code Service Agent<\/td>\n<\/tr>\n
Vulnerability Type<\/td>\nMalicious Tool Call (RCE)<\/td>\nInsecure Default Access (Viewer to Root)<\/td>\n<\/tr>\n
Initial Permission<\/td>\naiplatform.reasoningEngines.update<\/td>\naiplatform.persistentResources.get\/list<\/td>\n<\/tr>\n
Impact<\/td>\nLLM memories, chats, GCS access<\/td>\nRay cluster root; BigQuery\/GCS R\/W <\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/figure>\n

Agent Engine Tool Injection<\/strong><\/h2>\n

Developers deploy AI agents via frameworks like Google\u2019s Agent Development Kit (ADK), which pickles Python code and stages it in GCS buckets. Attackers with aiplatform.reasoningEngines.update permission upload malicious code disguised as a tool, such as a reverse shell in a currency converter function.<\/p>\n

\"Google\u2019s
Vulnerability Chain<\/figcaption><\/figure>\n

A query triggers the tool, executing the shell on the reasoning engine instance. Attackers then query metadata for the Reasoning Engine Service Agent token (service-<project>@gcp-sa-aiplatform-re.iam.gserviceaccount.com), gaining permissions for memories, sessions, storage, and logging. This reads chats, LLM data, and buckets. Public buckets work as staging, needing no storage rights, XM Cyber said<\/a>.<\/p>\n

Ray clusters for scalable AI workloads attach the Custom Code Service Agent to the head node automatically. Users with aiplatform.persistentResources.list\/get part of Vertex AI Viewer role access the GCP Console\u2019s \u201cHead node interactive shell\u201d link.<\/p>\n

\"Google\u2019s
Vulnerability Chain<\/figcaption><\/figure>\n

This grants root shell access despite viewer limits. Attackers extract the agent\u2019s token via metadata, enabling GCS\/BigQuery read-write, though IAM actions<\/a> like signBlob are scoped-limited in tests. The second diagram shows the pivot to cloud storage and logging.<\/p>\n

Revoke unnecessary Service Agent permissions using custom roles. Disable head node shells and validate tool code before updates. Monitor metadata accesses via Security Command Center\u2019s Agent Engine Threat Detection, which flags RCE and token grabs.<\/p>\n

Audit persistent resources and reasoning engines regularly. Enterprises adopting Vertex AI must treat these defaults as risks, not features.<\/p>\n

Follow us on Google News<\/a>, LinkedIn<\/a>, and X<\/a> for daily cybersecurity updates. Contact us<\/a> to feature your stories.<\/strong><\/p>\n

The post Google\u2019s Vertex AI Vulnerability Enables Low-Privileged Users to Gain Service Agent Roles<\/a> appeared first on Cyber Security News<\/a>.<\/p>\n<\/div>\n

\t

\n
<\/BR>
\n Guru Baran
\n \t

\n
<\/BR>
\nGo to cyber-security-news<\/a>
\n \t

\n
<\/BR><\/p>\n","protected":false},"excerpt":{"rendered":"

Google\u2019s Vertex AI Vulnerability Enables Low-Privileged Users to Gain Service Agent Roles Google\u2019s Vertex AI contains default configurations that allow low-privileged users to escalate privileges by hijacking Service Agent roles. XM Cyber researchers identified two attack vectors in the Vertex AI Agent Engine and Ray on Vertex AI, which Google deemed \u201cworking as intended. Service […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[129,63,648],"tags":[130],"class_list":["post-9962","post","type-post","status-publish","format-standard","hentry","category-cyber-security","category-cyber-security-news","category-vulnerability-news","tag-cyber-security-news"],"_links":{"self":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/9962"}],"collection":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/comments?post=9962"}],"version-history":[{"count":0,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/9962\/revisions"}],"wp:attachment":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/media?parent=9962"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/categories?post=9962"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/tags?post=9962"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}