Case vertex-ai-double-agentAgent hijackWorldwide
Vertex AI 'Double Agent': over-privileged agents leak credentials and code
Unit 42 showed agents deployed on Vertex AI inherited broad default service-account rights, letting a compromised agent steal credentials and reach restricted images and source code.
MediumAttack on AIStatus: PatchedVerified case file
Open in the interactive mapCite this case
- Reported
- Mar 31, 2026
- Location
- Worldwide
- Target
- Google Cloud Vertex AI Agent Engine
- Severity
- Medium
- Triggered by
- Security researchers at Palo Alto Networks Unit 42 (responsible disclosure)
- Actor type
- Security researchers
- Reported loss
- None reported
- CVE
- None
What happened
Unit 42 showed agents deployed on Vertex AI inherited broad default service-account rights, letting a compromised agent steal credentials and reach restricted images and source code.
Impact: Proof of concept only: a deployed agent could return service-agent credentials, reach customer data, internal Dockerfiles and Google internal Artifact Registry contents; no confirmed real-world victims
Who triggered it
Actor: Security researchers at Palo Alto Networks Unit 42 (responsible disclosure)
Attribution: Self-attributed research by Unit 42; Google confirmed and worked with researchers on the fix
Motive: Security research and responsible disclosure
How it happened
Attack vector: Code running inside a deployed ADK agent queried the GCP instance metadata service to obtain the OAuth token of the Google-managed service agent (P4SA)
Root cause: Vertex AI Agent Engine attached a default per-product service agent with broad permissions, so any compromised or malicious agent inherited over-privileged, Google-managed identity
Timeline
- Unit 42 demonstrates credential extraction and access to customer data and Google-internal Artifact Registry images
- Unit 42 publishes Double Agents research after responsible disclosure to Google
- Google confirms production image tampering was blocked and updates Vertex AI permissions documentation
Response
Google worked with Unit 42, confirmed internal controls block tampering with production images, rewrote agent permission docs and recommends Bring Your Own Service Account (least privilege) for Vertex AI deployments
Current status: Patched
Sources (open in a new tab)
- Unit 42 (Palo Alto Networks) unit42.paloaltonetworks.com
- TechRadar techradar.com
- Cloud Security Alliance labs.cloudsecurityalliance.org
Cite this case
Vertex AI 'Double Agent': over-privileged agents leak credentials and code. AI Threat Watch, case vertex-ai-double-agent, Mar 31, 2026. https://aithreat.io/cases/vertex-ai-double-agent/
Permanent link: https://aithreat.io/cases/vertex-ai-double-agent/