New cybersecurity research has revealed two significant vulnerabilities in Google’s Vertex AI artificial intelligence platform. The flaws, identified by security company XM Cyber, allow users with minimal permissions to escalate their privileges, gaining access to much more powerful functions within the cloud environment. The core problem lies in the platform’s default settings, which grant overly broad permissions to automated service accounts.
The discovery exposes a latent risk for organizations that rely on Google Cloud’s AI infrastructure, especially in relation to insider threats. A malicious user or compromised account with basic access could exploit this loophole to manipulate critical resources, access sensitive data, or perform unauthorized actions. In its response, Google stated that the observed behavior is in line with the original design of the platform, shifting the responsibility for mitigation to customers.
The alert reinforces the need for stricter security governance in managed AI services. The convenience offered by the default settings, which aim to facilitate the use of the tool, ends up creating attack vectors that can go unnoticed by security teams. Especialistas recommend an immediate review of access policies and closer monitoring of service account activities.
How Escalation Failure Works
The vulnerability exploits the way Google Vertex AI manages its service accounts, known as “service agents.” Essas are special identities, automatically managed by Google Cloud, designed to allow different platform services to interact with each other and access user resources to perform internal tasks such as training AI models or processing data. To ensure full platform functionality, these agents are granted, by default, a broad set of project-level permissions. Research by XM By possessing this token, the attacker effectively assumes the identity and elevated privileges of the service account, allowing them to perform actions far beyond their original scope, turning a supposedly secure, managed identity into a powerful insider attack vector.
Google’s official response on the design
After being notified about the vulnerabilities by XM Cyber, Google Cloud analyzed the report and concluded that the behavior of the service agents operates as intended. The company classified the issue not as a flaw to be fixed, but as an intentional feature of the Vertex AI design. Essa approach prioritizes ease of use and rapid feature deployment, ensuring that users can enable and utilize AI capabilities without the need for complex permissions configuration from the start. Service agents are designed to operate transparently in the background, with broad access to support complex integrations between different cloud services.
This design philosophy, however, places a significant burden on customers. By accepting default settings, companies implicitly accept a security model that may not be aligned with their own governance policies and risk tolerance. Analistas indicate that this practice subordinates corporate security models to the cloud provider’s architecture, reducing the visibility and control that security teams have over critical internal components of the platform. Google’s decision not to change this behavior reinforces the importance of the shared responsibility model, in which customers are responsible for properly configuring and monitoring the services they use.
Implications for corporate security
The risks presented by these excessive permissions are particularly serious in the context of insider threats. A malicious employee or attacker who has compromised a low-privilege account can use this technique to move laterally through the network.
Exploitation of these service accounts is subtle and difficult to detect. Como actions are performed by an identity managed by Google itself, traditional security monitoring tools may interpret the activity as legitimate and routine.
AI environments often process and store large volumes of sensitive data, including customer information, intellectual property and trade secrets. A compromise in this area can have a devastating impact.
The lack of adequate isolation between projects and the reliance on broad permissions means that a single breach can lead to unauthorized access to databases, storage systems, and other critical applications connected to the AI platform.
History of security issues on the platform
This is not the first time that Vertex AI’s permissions architecture has been questioned by security researchers. In November 2024, Palo Alto Networks disclosed a different set of vulnerabilities on the same platform, which also allowed privilege escalation and exfiltration of machine learning models.
At that time, the failures were related to “custom jobs” and improper access to AI models that had been adjusted with proprietary customer data. Google responded promptly, applying fixes to the specific issues that were reported.
The recurrence of vulnerabilities linked to privilege management suggests a structural pattern in the design of managed AI platforms. Para simplify the user experience, these platforms tend to grant elevated permissions by default to their internal components, creating an ongoing security challenge.
Connection to OWASP Guidelines
The findings are directly aligned with emerging risks cataloged by the security community. In December 2025, the OWASP (Open Web Application Security Project) project released the “Top 10 for Aplicações Agentic”, a guide focused on security risks specific to autonomous AI systems.
The Vertex AI vulnerability falls squarely into the ASI03 category, which deals with “Abuse of Identidade and Privilégios in Sistemas Autônomos AI.” Essa category highlights the danger of actors being given access to tools and resources without the necessary granular restrictions to limit their scope of action.
The question of invisible identities
One of the biggest challenges highlighted by this vulnerability is the management of “invisible identities”, such as service agents. Diferente of human user accounts, these automated identities operate in the background, are created automatically by the platform, and are often not audited as rigorously by security teams, who tend to focus on threats originating from human accounts.
Recommended mitigation measures
Cloud security experts recommend that companies using Vertex AI adopt a proactive stance to mitigate these risks. The first step is to perform a thorough audit of all service identities associated with your AI workloads, identifying what permissions each has and whether they are strictly required.
It is crucial to implement specific monitoring for the activity of these service agents, treating them as privileged accounts. Isso involves creating alerts for abnormal behavior patterns, such as accessing resources outside the usual scope or executing commands at unusual times, which may indicate improper manipulation.
Cloud Shared Responsibility
This case serves as a stark reminder of the shared responsibility model in cloud computing. Enquanto the provider, like Google, is responsible for security “of” the cloud (physical infrastructure and basic services), the customer is responsible for security “in” the cloud.
This includes correctly configuring permissions, managing identities and access, and monitoring your own applications and data. Blindly Confiar in the default settings of any managed service, especially in areas as critical as AI, exposes organizations to significant security gaps that can be exploited by attackers.
