Palo Alto Unit 42: "Double Agents" Hijack GCP Vertex AI Agent Engine
Palo Alto Unit 42: "Double Agents" Hijack GCP Vertex AI Agent Engine is a high-severity credential theft issue in GCP Vertex AI Agent Engine, an AI agent. Affected: GCP Vertex AI Agent Engine (default permission scoping).
Is GCP Vertex AI Agent Engine running on your developers' machines? Anomity finds every device with this AI agent installed, shows the version, and can block it by policy. Detect this across your developers' devices with Anomity →
Key facts
- ID
palo-alto-unit-42-double-agents-hijack-gcp-vertex-ai-agent-engine- Severity
- high
- Attack type
- Credential theft
- Component
- GCP Vertex AI Agent Engine · AI agent
- Known exploited
- No known exploitation
- Published
- Last verified
What is this vulnerability?
Unit 42 demonstrated a multi-step attack chain against Google Cloud Vertex AI Agent Engine that extracts the service agent's default credentials, enabling cross-boundary data access and RCE. A deployed agent can then be weaponized as a "double agent", appearing to serve its intended workload while silently exfiltrating data, compromising other agents in the same project, and creating persistent backdoors via the engine's permissive default permission scoping.
Affected versions
| Affected | Fixed in |
|---|---|
GCP Vertex AI Agent Engine (default permission scoping) | No fixed version listed |
Am I affected by this vulnerability?
You are affected if you run GCP Vertex AI Agent Engine (default permission scoping).
How do I fix it?
Audit Vertex AI service agents for excess permissions; apply least-privilege scoping. Rotate service-account keys associated with deployed agents. Enable VPC Service Controls around Vertex AI projects. Monitor BigQuery and Cloud Storage access from agent identities.
How do I find every machine running GCP Vertex AI Agent Engine?
Anomity inventories the AI agents, MCP servers, IDE extensions and skills on each developer device, so you can see which machines run GCP Vertex AI Agent Engine and which version, then enforce a policy on it.