Google’s Vertex AI Vulnerability Enables Low-Privileged Users to Gain Service Agent Roles
Google's Vertex AI has been identified to contain default configurations that could allow low-privileged users to escalate their privileges by hijacking Service Agent roles. Researchers from XM Cyber have identified two attack vectors within the Vertex…
Google's Vertex AI has been identified to contain default configurations that could allow low-privileged users to escalate their privileges by hijacking Service Agent roles. Researchers from XM Cyber have identified two attack vectors within the Vertex AI Agent Engine and Ray on Vertex AI, which have been categorized by Google as operating as intended.
Service Agents are managed identities that are automatically attached to Vertex AI instances by Google Cloud for internal operations. These accounts are assigned broad project permissions by default, posing risks if accessed by low-privileged users. Attackers can exploit these permissions through confused deputy scenarios, leading to remote code execution (RCE) and credential theft from instance metadata.
The attack paths start with read-only permissions but could lead to high-privilege actions such as accessing Google Cloud Storage (GCS) or BigQuery. A diagram illustrates the Ray on Vertex AI flow, detailing the progression from persistent resource access to the compromise of the Custom Code Service Agent.
Feature Vertex AI Agent Engine Ray on Vertex AI
Primary Target Reasoning Engine Service Agent Custom Code Service Agent
Service Agents are managed identities that are automatically attached to Vertex AI instances by Google Cloud for internal operations.
Vulnerability Type Malicious Tool Call (RCE) Insecure Default Access (Viewer to Root)
Initial Permission aiplatform.reasoningEngines.update aiplatform.persistentResources.get/list
Impact LLM memories, chats, GCS access Ray cluster root; BigQuery/GCS R/W
Developers deploy AI agents using frameworks like Google's Agent Development Kit (ADK), which pickle Python code and stage it in GCS buckets. Attackers with the aiplatform.reasoningEngines.update permission can upload malicious code disguised as a tool, such as a reverse shell within a currency converter function. A query triggers this tool, executing a shell on the reasoning engine instance, allowing attackers to query metadata for the Reasoning Engine Service Agent token, thus gaining permissions for memories, sessions, storage, and logging.
To mitigate these risks, it is recommended to revoke unnecessary Service Agent permissions using custom roles, disable head node shells, and validate tool code prior to updates. Additionally, monitoring metadata accesses via the Security Command Center's Agent Engine Threat Detection can help flag RCE attempts and token grabs. Regular audits of persistent resources and reasoning engines are advised. Organizations adopting Vertex AI should view these default configurations as potential security risks.
Based on reporting by Cyber Security News.