Cybersecurity firm XM Cyber has revealed the discovery of two critical vulnerabilities in the Google Vertex AI artificial intelligence platform. The flaws allow users with minimal permissions, such as a simple viewer, to escalate their privileges and access service accounts with much broader authorizations. Esta breach directly exploits the tool’s default settings, raising an alert about the security of managed AI services.
The central problem lies in the “service agents”, special accounts managed by Google Cloud that perform tasks on the user’s behalf. By default, these accounts are granted extensive permissions to ensure the seamless functioning of the platform’s features. However, this convenience creates a significant attack vector that can be exploited by internal malicious actors or compromised accounts to move laterally within a cloud environment.
In response to the responsible disclosure made by XM Cyber, Google stated that the identified behavior operates in accordance with the platform’s original design, classifying it as intentional. Essa position reinforces the need for companies to adopt a proactive security posture rather than blindly trust cloud providers’ default configurations, especially in environments that deal with sensitive data and machine learning models.
Technical details of the exploration
Exploitation of the vulnerabilities is based on the way Google Vertex AI manages the identity and access of its internal components. Service agents are automatically created to facilitate complex operations such as model training, running data pipelines, and deploying endpoints. Para To allow these tasks to occur without interruption, the platform grants these identities a broad set of project-level permissions. XM Once in possession of these tokens, the attacker effectively assumes the privileges of the service account, which often include editor or administrator permissions on various Google Cloud features such as BigQuery and Cloud Storage. Esse escalation method is particularly dangerous because the activity generated by the compromised service agent appears legitimate to monitoring tools, masking the breach as normal platform operation and making malicious activity difficult to detect.
More on this story: Vulnerability in Google’s Vertex AI allows privilege escalation by default settings
Google’s answer and the philosophy of ‘intentional design’
The official position of Google Cloud, which classifies behavior as a design characteristic, highlights a common philosophy in cloud platforms that prioritize ease of use and rapid implementation. By providing broad permissions by default, the company removes barriers for developers and data scientists to leverage AI capabilities without the need for complex identity and access management (IAM) setups. Essa approach accelerates innovation but shifts a significant portion of security responsibility to the customer.
Security analysts point out that this strategy subordinates corporate governance models to the provider’s architecture. Enterprises lose visibility and granular control over the “invisible identities” operating in their environments. The incident serves as a critical reminder of the shared responsibility model in the cloud: while the provider is responsible for security *of* the cloud, the customer is responsible for security *in* the cloud. Isso includes properly configuring permissions, auditing service accounts, and implementing additional security controls to protect workloads.
Implications for corporate security
The holes identified in Vertex AI considerably increase the risks associated with insider threats. A malicious employee or attacker who has compromised a low-privilege account can use this technique to access and exfiltrate sensitive data.
Manipulating service agents is a stealthy tactic, as it does not trigger traditional security alerts that monitor the creation of new user permissions. Operations carried out with stolen tokens are recorded as legitimate actions carried out by the platform itself.
Enterprise security tools, such as endpoint detection and response (EDR) or security information and event management (SIEM) systems, are rarely configured to monitor the behavior of provider-managed identities, creating a significant blind spot in the defense posture.
AI environments often process large volumes of sensitive information, and the lack of adequate isolation between resources allows an initial compromise to spread quickly, dramatically increasing the impact radius of a security breach.
Learn more: Experts warn of excessive permissions in Google Vertex AI service agents
Vertex AI Security History
This is not the first time that the security of the Vertex AI platform has been questioned. In November 2024, researchers at Palo Alto Networks disclosed similar vulnerabilities that allowed privilege escalation through “custom jobs” and exfiltration of machine learning models.
At that time, Google implemented fixes for the specific issues reported. However, the recurrence of failures related to privilege management suggests structural challenges in the design of managed AI platforms, which, by nature, need to grant a high degree of autonomy to their internal agents to function effectively.
Alignment with OWASP guidelines
The findings are in line with emerging risks cataloged by Open Web Application Security Project (OWASP). In December 2025, the organization released “OWASP Top 10 for Large Language Model Applications”, a guide to key security risks in AI systems.
The Vertex AI vulnerability falls squarely into the ASI03 category, which addresses abuse of identity and privileges in autonomous AI systems. Esta category warns of the danger of agents being given excessive access to tools and resources without sufficient granular restrictions.
The OWASP framework serves as an essential reference for security teams to assess and mitigate risks in AI platforms, highlighting that excessive reliance on third-party components can lead to significant security flaws.
Mitigation measures and expert recommendations
To mitigate risks, security experts recommend that companies using Vertex AI immediately implement compensatory controls. The first step is to perform a full audit of all service identities associated with AI workloads, applying the principle of least privilege whenever possible.
On the same topic: Z.ai’s new GLM-5.3 advances in cybersecurity and coding, revealing vulnerability in Cursor
It is crucial to implement specific monitoring for the activity of these service agents, treating them as privileged accounts. Isso involves creating alerts for abnormal behavior patterns, such as accessing data or APIs outside the scope of your usual role. Segmenting resources and creating security barriers between different projects can limit an attacker’s range of action in the event of a compromise.
The future of governance on AI platforms
The rapid evolution and adoption of artificial intelligence tools requires constant adaptation in defense and governance strategies. Organizations need to balance the agility provided by managed services with the need to maintain control and visibility over their cloud environments, recognizing that security is a shared responsibility.