Transitive Access Abuse - Data Exfiltration via Document AI by Kat Traxler

**TLDR:** The Document AI service auto-assigns a Google-managed service agent with broad project-level Cloud Storage permissions, allowing batch processing jobs to read and write any Cloud Storage objects in the same project and enabling data exfiltration via transitive access abuse; the report provides PoC Terraform modules, a detailed disclosure timeline with Google, and mitigation recommendations such as project segmentation and org policy constraints.