Back Gbhackers

Google Cloud’s Vertex AI Hit by Vulnerability Enabling Sensitive Data Access

Gbhackers •Divya • April 1, 2026

Artificial intelligence agents are transforming enterprise workflows, but they also introduce dangerous new attack vectors. Security researchers from Palo Alto Networks’ Unit 42 recently uncovered a significant vulnerability in Google Cloud Platform’s (GCP) Vertex AI Agent Engine. By exploiting overly broad default permissions, attackers can deploy a malicious “double agent” to secretly exfiltrate sensitive data […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Vulnerability in Google Cloud's Vertex AI Exposes Sensitive Data to Attackers Researchers from Palo Alto Networks have identified a significant vulnerability in Google Cloud's Vertex AI platform, which allows attackers to exploit default permissions of AI agents. This vulnerability enables attackers to turn deployed AI agents into 'double agents' capable of exfiltrating sensitive data and compromising cloud infrastructure. The excessive default permissions associated with the Per-Project, Per-Product Service Agent (P4SA) pose a critical risk, as attackers can gain unauthorized access to sensitive areas of a customer's cloud environment. The findings prompted Google to update its documentation and recommend that organizations implement least-privilege access by replacing default service accounts with custom ones. The vulnerability highlights the need for better identity management and permission settings in AI deployments. As organizations increasingly rely on AI for operational workflows, the risk of such vulnerabilities becoming exploited grows. The situation remains urgent as organizations are advised to reassess their configurations to mitigate potential attacks. 7 sources 71

Extracted Entities

Google Cloud’s Vertex AI Hit by Vulnerability Enabling Sensitive Data Access

The full story

Extracted Entities

Attack Types (1)

Companies (2)

MITRE ATT&CK (1)

Platforms (1)