Loading story…
Palo Alto Networks Unit 42 disclosed a weakness in Google Cloud Vertex AI that could let attacker-controlled AI agents extract credentials from the platform’s Per-Project, Per-Product Service Agent (P4SA) and use them to access customer resources. The issue affects deployments built with the Agent Development Kit through Agent Engine, where excessive default permissions weakened isolation between the AI agent runtime and the customer’s Google Cloud project. Researchers said exposed service-agent credentials could be abused to gain broad read access to Google Cloud Storage data and to view restricted Google-owned Artifact Registry repositories linked to Vertex AI infrastructure.
Unit 42 said the flaw also exposed details about internal Google infrastructure and potentially proprietary code associated with the Vertex AI Reasoning Engine. Researchers further warned that insecure Python pickle usage and broad, non-editable OAuth 2.0 scopes could expand the blast radius beyond GCP into Google Workspace services such as Gmail, Google Calendar, and Google Drive. Google responded by updating its guidance and urging customers to adopt Bring Your Own Service Account (BYOSA) and least-privilege controls to reduce the risk.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
In response to the findings, Google updated its documentation to recommend the Bring Your Own Service Account model and least-privilege controls for Vertex AI deployments. The guidance was intended to reduce the risk posed by the default service-agent permissions.
Unit 42 showed that stolen Vertex AI service-agent credentials could be used to gain broad read access to customer Google Cloud Storage data and visibility into restricted Google-owned Artifact Registry repositories associated with Vertex AI infrastructure. The research also warned about insecure Python pickle usage and broad OAuth scopes that could potentially extend access to Google Workspace services.
Palo Alto Networks Unit 42 found that Google Cloud Vertex AI Agent Engine deployments using the Agent Development Kit assigned overly broad default permissions to the Per-Project, Per-Product Service Agent. The researchers determined this could let an attacker-controlled AI agent extract service-agent credentials and break isolation between the agent runtime and a customer's Google Cloud project.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcethehackernews.com
Open sourcesdxcentral.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Palo Alto Networks Unit 42 disclosed a critical vulnerability in the Google Cloud Vertex AI SDK for Python that allowed attackers to hijack model uploads and achieve cross-tenant remote code execution in Vertex AI serving infrastructure. The issue affected `google-cloud-aiplatform` versions `1.139.0` and `1.140.0` and was caused by a predictable default staging bucket name and missing ownership verification during the SDK’s staging process. With only their own Google Cloud project and a victim’s project ID, an attacker could pre-create the expected bucket, intercept uploaded model artifacts, and swap in a malicious file during an approximately 2.5-second race window. The attack abused Python `pickle`/`joblib` deserialization so that malicious code ran when the victim later deployed the poisoned model. Unit 42 said the technique could expose service account credentials from the serving environment and provide access to tenant-project resources including other model artifacts, BigQuery metadata, and Cloud Logging data. Google accepted the report and released fixes in versions `1.144.0` and `1.148.0`; defenders are advised to upgrade to `1.148.0` or later and explicitly configure a staging bucket where appropriate.
Jun 29, 2026
Palo Alto Networks Unit 42 disclosed **ModeLeak**, a security issue in Google Cloud **Vertex AI** that allowed an attacker to escalate privileges and exfiltrate hosted **large language models**. The report indicates the flaw affected the trust boundaries around managed AI services, creating a path from lower-privileged access to unauthorized retrieval of proprietary model assets stored or served through Vertex AI. The finding highlights a high-impact cloud AI risk: organizations using managed model platforms could face theft of valuable intellectual property if identity, access controls, and service permissions are misconfigured or insufficiently isolated. The disclosure underscores the need for defenders to review **IAM roles**, service account permissions, and model access paths in Vertex AI environments to prevent unauthorized access to hosted models and related AI resources.
Jul 8, 2026
Microsoft disclosed two critical vulnerabilities in its **Semantic Kernel** AI agent framework that could let prompt injection escalate into host compromise. `CVE-2026-26030` affected the Python implementation before version `1.39.4`, where unsafe `eval()`-based lambda construction in the Search Plugin’s default In-Memory Vector Store filter path enabled remote code execution, while `CVE-2026-25592` affected the .NET SDK before version `1.71.0` and allowed arbitrary file write through `SessionsPythonPlugin`’s `DownloadFileAsync`, creating a path to sandbox escape and host takeover; a related arbitrary file read issue was also present in upload handling. Microsoft said it hardened AST validation, restricted callable functions and attributes, removed unintended tool exposure, added path validation, and urged customers to patch and review endpoint telemetry for signs of exploitation. The disclosure lands amid broader warnings that AI agents can preserve and amplify malicious instructions through memory and context reuse. Cisco researchers recently showed that poisoned memory files in Anthropic’s **Claude Code** could persist across projects and sessions, steering the assistant to insert hard-coded secrets, choose insecure packages and configurations, and spread tainted changes to another developer. Researchers and defenders say the incidents reinforce that AI models are not security boundaries and that any model-influenced tool parameter, memory file, or context artifact should be treated as attacker-controlled input, with mitigations including patching vulnerable frameworks, scanning memory and dependency files, and purging stored agent memory after suspected compromise.
Jun 29, 2026