Research explained
Vertex AI research questioned the default reach of agent service identities
Unit 42’s reported findings focus on service-agent permissions and the consequences of a compromised execution context.
What happened
March 2026 reporting described Unit 42 research into Vertex AI Agent Engine service identities. The researchers showed how credentials available to a deployed agent could provide access beyond the application’s intended task, including customer-project storage.
The report distinguishes access to listed resources from permission to read them: some exposed tenant-bucket information did not grant access to bucket contents. That distinction should not be flattened into a claim that all Google Cloud data was public.
Review the permissions of service identities attached to agent workloads and limit access to the required resources. A model-level safeguard does not replace IAM controls when code can obtain credentials inside its execution environment.
Next step
Review agent service identities and restrict project-level data permissions.
What remains unknown
- Open question
- The sources reviewed do not establish whether your deployment was exploited.
Source references
-
THE