Disclosed weakness · no CVE recorded

Double Agents: Vertex AI default service-agent permissions

Google Cloud · Vertex AI Agent Engine

First documented disclosure · Review checkpoint

Summary

Unit 42 demonstrated that a malicious or compromised deployed agent could misuse its default service identity.

Severity and exploitation evidence

No CVSS score recorded in this review.

Exploitation not established: The reviewed sources establish a disclosed weakness or researcher demonstration, not malicious exploitation in the wild.

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The agent runtime exposes credentials whose default permissions reach beyond the intended task.

Conditions required

An attacker-controlled or compromised deployed agent with the relevant service-account permissions.

Potential impact

Access to consumer-project data and some producer-project artifacts in the researchers’ environment.

Affected versions and configurations

Hosted Agent Engine configuration using the described default service agent; no version range supplied.

Fix and mitigation status

No universal software patch claimed; Google documented behavior and recommended a dedicated customer-managed service account.

Practical next steps

Use a dedicated least-privilege service account and verify resource permissions before deploying third-party agents.

Operating lesson

The effective authority is the runtime identity’s permissions, not the agent’s stated purpose.

Evidence and limits

Research demonstration, no CVE reported. Google confirmed controls prevent modification of production base images; Workspace access also requires IAM permissions. Proposed pickle exploitation was not tested.

Sources