Palo Alto Networks Researchers Show How Google Cloud AI Agents Can Be Weaponized Against the Businesses That Build Them

Artificial intelligence agents are rapidly becoming a core part of how businesses operate — automating workflows, managing data, and interacting with cloud infrastructure at scale. But new research from Palo Alto Networks reveals a serious and largely overlooked risk: these same agents can be compromised by attackers and turned against the very organizations that built them.

The research focused on Google Cloud's Vertex AI platform — specifically the Vertex Agent Engine and Agent Development Kit (ADK), which are widely used by developers to create, deploy, manage, and scale AI agents. The findings reveal that vulnerabilities in how these agents are configured by default could allow attackers to hijack them, turning helpful automation tools into what the researchers describe as "double agents."

The core vulnerability — excessive permissions by default

At the heart of the issue is a component called the Per-Project, Per-Product Service Agent — known as P4SA. This is a service account automatically associated with every user-deployed AI agent on Google Cloud, enabling it to access resources within the Google Cloud Platform.

The problem, according to Palo Alto's researchers, is that P4SA carries excessive permissions by default. An attacker who gains access to these credentials does not just compromise the AI agent itself — they gain the ability to move from the agent's execution environment into the owner's broader Google Cloud project, including all associated data storage.

"This level of access constitutes a significant security risk, transforming the AI agent from a helpful tool into an insider threat," the researchers explained.

What an attacker can do once inside

The research outlines a chain of escalating access that makes this vulnerability particularly serious for businesses:

Using compromised P4SA credentials, an attacker can gain unrestricted access to the Google Cloud project hosting Vertex AI. From there they can download container images from private repositories — images that form the core of the Vertex AI Reasoning Engine. As the researchers noted, gaining access to this proprietary code not only exposes sensitive intellectual property but also provides attackers with a blueprint for finding further vulnerabilities.

Beyond this, the compromised credentials can be used to access restricted Artifact Registry repositories and Google Cloud Storage buckets containing potentially sensitive business data. The researchers also identified a file within the agent environment that could be manipulated to achieve remote code execution — enabling an attacker to establish a powerful and persistent backdoor that survives standard remediation efforts.

In short, a single compromised AI agent could give an attacker a foothold into an organization's entire cloud infrastructure.

How Google has responded

Palo Alto Networks shared its findings with Google through responsible disclosure. Google has since revised its documentation to highlight these potential risks and now recommends that organizations adopt a Bring Your Own Service Account approach — known as BYOSA — when deploying agents through Agent Engine.

BYOSA allows organizations to enforce the principle of least privilege, ensuring AI agents are only granted the specific permissions they need to function — significantly reducing the blast radius if an agent is ever compromised. Google has also confirmed that strong, non-overridable controls are in place to prevent service agents from altering production images.

Why this matters for GCC and MENA businesses

Across the GCC, AI adoption is accelerating at a remarkable pace. Saudi Arabia's Vision 2030, the UAE's National AI Strategy, and major investments in smart government and digital enterprise across Qatar, Kuwait, and Bahrain are all driving rapid deployment of AI agents and cloud infrastructure — much of it built on platforms like Google Cloud Vertex AI.

For businesses in the region building or planning to deploy AI agents, this research is a direct and timely warning. The risk is not hypothetical — Palo Alto's researchers demonstrated these attack chains in a real environment. Any organization using Vertex AI Agent Engine without reviewing its service account permissions is potentially exposed right now.

Is your business building AI agents on Google Cloud?

If your organization is deploying AI agents — or planning to — on Google Cloud's Vertex AI platform, now is the time to have a conversation with your development or cloud team about service account permissions. The default configuration may be leaving your cloud infrastructure more exposed than you realize.

Adopting least-privilege principles for AI agent deployments is not just a technical best practice — it is rapidly becoming a business necessity as AI agents take on greater responsibility within organizations. A specialist review of your current AI infrastructure security posture could identify risks before attackers do.