{"data":{"id":"cab7c11e-d476-4f81-b349-b6bf778a5543","title":"Vertex AI Vulnerability Exposes Google Cloud Data and Private Artifacts","summary":"Researchers discovered a security vulnerability in Google Cloud's Vertex AI platform where AI agents could be compromised to steal sensitive data and access private cloud resources. The problem stems from the default service agent (P4SA, a special account that runs the AI agent) having excessive permissions, allowing attackers to extract credentials and gain unauthorized access to cloud storage, private code repositories, and internal Google infrastructure.","solution":"Google updated its documentation to explain how Vertex AI uses resources and accounts. The company recommended that customers use Bring Your Own Service Account (BYOSA) to replace the default service agent and enforce the principle of least privilege (PoLP, giving the agent only the permissions it needs to do its job).","labels":["security"],"sourceUrl":"https://thehackernews.com/2026/03/vertex-ai-vulnerability-exposes-google.html","publishedAt":"2026-03-31T13:09:00.000Z","cveId":null,"cweIds":null,"cvssScore":null,"cvssSeverity":null,"severity":"high","attackType":["data_extraction","supply_chain"],"issueType":"news","affectedPackages":null,"affectedVendors":["Google"],"affectedVendorsRaw":["Google Cloud","Vertex AI","Google Cloud Platform (GCP)","Google Cloud Storage","Artifact Registry"],"classifierModel":"claude-haiku-4-5-20251001","classifierPromptVersion":"v3","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":null,"epssScore":null,"patchAvailable":null,"disclosureDate":"2026-03-31T13:09:00.000Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity"],"aiComponentTargeted":"agent","llmSpecific":false,"classifierConfidence":0.92,"researchCategory":null,"atlasIds":null}}