Google’s Vertex AI Vulnerability Enables Low-Privileged Users to Gain Service Agent Roles

XM Cyber and related reporting disclose default-configuration vulnerabilities in Google Vertex AI that permit privilege escalation through two paths: a malicious tool call in the Reasoning Engine (leading to RCE and theft of the Reasoning Engine Service Agent token) and insecure default access on Ray head nodes (viewer access enabling a root shell and theft of the Custom Code Service Agent token). Successful exploitation can expose LLM data, chats, and give read/write access to Cloud Storage and BigQuery; recommended mitigations include revoking unnecessary Service Agent permissions, disabling head node shells, validating staged tool code, and monitoring metadata access.