{
  "entry": {
    "kind": "vuln",
    "slug": "palo-alto-unit-42-double-agents-hijack-gcp-vertex-ai-agent-engine",
    "name": "palo-alto-unit-42-double-agents-hijack-gcp-vertex-ai-agent-engine",
    "vendor": "GCP Vertex AI Agent Engine",
    "description": "Unit 42 demonstrated a multi-step attack chain against Google Cloud Vertex AI Agent Engine that extracts the service agent's default credentials, enabling cross-boundary data access and RCE. A deployed agent can then be weaponized as a \"double agent\", appearing to serve its intended workload while silently exfiltrating data, compromising other agents in the same project, and creating persistent backdoors via the engine's permissive default permission scoping.",
    "website": "https://unit42.paloaltonetworks.com/double-agents-vertex-ai/",
    "repository": null,
    "documentationUrl": null,
    "license": null,
    "version": null,
    "trustLevel": "advisory",
    "capabilities": [],
    "packaging": null,
    "configFiles": null,
    "category": "agent",
    "updatedAt": "2026-05-06",
    "risk": {
      "score": 75,
      "band": "high",
      "signals": [],
      "dangerousCombos": []
    },
    "dangerousCombos": [],
    "vuln": {
      "id": "palo-alto-unit-42-double-agents-hijack-gcp-vertex-ai-agent-engine",
      "aliases": [
        "ti-019"
      ],
      "title": "Palo Alto Unit 42: \"Double Agents\" Hijack GCP Vertex AI Agent Engine",
      "summary": "Unit 42 demonstrated a multi-step attack chain against Google Cloud Vertex AI Agent Engine that extracts the service agent's default credentials, enabling cross-boundary data access and RCE. A deployed agent can then be weaponized as a \"double agent\", appearing to serve its intended workload while silently exfiltrating data, compromising other agents in the same project, and creating persistent backdoors via the engine's permissive default permission scoping.",
      "severity": "high",
      "cvss": {
        "score": null,
        "vector": null,
        "version": null
      },
      "cwe": [],
      "attackType": [
        "Credential theft"
      ],
      "componentType": "agent",
      "component": {
        "name": "GCP Vertex AI Agent Engine",
        "vendor": null,
        "package": null,
        "ecosystem": null,
        "catalogSlug": null
      },
      "affected": [
        {
          "range": "GCP Vertex AI Agent Engine (default permission scoping)",
          "fixed": null
        }
      ],
      "exploited": false,
      "exploitPublic": false,
      "publishedAt": "2026-05-06",
      "modifiedAt": "2026-05-06",
      "lastVerified": "2026-11-01",
      "references": [
        {
          "type": "article",
          "url": "https://unit42.paloaltonetworks.com/double-agents-vertex-ai/"
        }
      ],
      "mitigation": "Audit Vertex AI service agents for excess permissions; apply least-privilege scoping. Rotate service-account keys associated with deployed agents. Enable VPC Service Controls around Vertex AI projects. Monitor BigQuery and Cloud Storage access from agent identities.",
      "detectedByAnomity": true
    }
  }
}