Double Agents in the Cloud: Unit 42 Unmasks Critical AI Vulnerabilities in Google Vertex AI

Unit 42 research identified critical permissioning flaws in Google Vertex AI agents that allow a compromised agent to extract service-agent credentials from the metadata service, gain broad read access to Google Cloud Storage buckets across a consumer project, and access restricted Google-owned Artifact Registry repositories to download private container images. The report also highlights insecure packaging (Python pickle) enabling RCE and persistent backdoors, over-permissive default OAuth scopes and P4SA permissions, and recommends BYOSA and stricter permission and integrity checks to mitigate the risk of AI agents becoming persistent “double agents.”