Google Vertex AI Flaws Allow Low-Privileged Users to Hijack Service Agents
Take action: Audit your Google Cloud IAM roles to ensure 'Viewer' users cannot access interactive shells on Ray clusters. Restrict update permissions on reasoning engines to prevent malicious code injection into your AI workflows.
Learn More
Google Vertex AI contains two privilege escalation paths that let low-privileged users hijack high-privilege Service Agents. These flaws affect the Vertex AI Agent Engine and Ray on Vertex AI. Researchers from XM Cyber discovered that default configurations allow attackers to turn "Viewer" permissions into project-wide access. Google currently views these services as working as intended, meaning the risks remain active in standard deployments.
The first attack targets the Vertex AI Agent Engine. Users with the aiplatform.reasoningEngines.update permission can inject malicious Python code into tool definitions. By embedding a reverse shell in a standard function, an attacker gains remote code execution on the compute instance. Once inside, they query the instance metadata service to steal the Reasoning Engine Service Agent token. This agent holds broad rights to access AI memories and storage buckets.
The second flaw involves Ray on Vertex AI. Users with the standard "Vertex AI Viewer" role can access a "Head node interactive shell" directly through the Google Cloud console. This shell provides root access to the head node. From this elevated position, attackers extract the Custom Code Service Agent token. While the token has some IAM limits, it grants full control over several data services across the cloud platform.
Hijacking these Service Agents exposes sensitive corporate data and infrastructure. Attackers can use the stolen identities to read, write, or delete resources. Exposed data items can include:
- Vertex AI chat sessions and LLM memories
- Google Cloud Storage (GCS) buckets and private objects
- BigQuery datasets and Pub/Sub streams
- System logs and monitoring data
- Cloud platform metadata and project configurations
Teams should move away from default Google Cloud roles and vreate custom roles that follow the principle of least privilege. Disable head node shell access for Ray clusters and audit all Python code before updating reasoning engines.
