Fine-tune an LLM on Vertex AI, own the whole GCP project A security researcher demonstrated that the `aiplatform.customJobs.create` permission in Google Cloud's Vertex AI allows privilege escalation to full project control, contradicting Google's documentation that the Custom Code Service Agent cannot obtain cloud-platform-scoped tokens. The researcher successfully minted tokens for any service account and read the project IAM policy, but Google marked the report as "Won't Fix (Infeasible). Fine-tune an LLM on Vertex AI, own the whole GCP project https://blog.himanshuanand.com/2026/06/fine-tune-an-llm-on-vertex-ai-own-the-whole-gcp-project/ Table of Contents If your team trains models or fine tunes LLMs on Vertex AI, one training permission is all it takes to take over the whole project. TLDR; A principal with one permission aiplatform.customJobs.create can run code as google’s managed Custom Code Service Agent, which hands out a cloud platform token the exact scope Google’s docs says it can’t have and can mint tokens for any service account in the project. That is low priv ML role turning into effective project Editor, no actAs, no user interaction. It’s the same primitive published by Unit 42 Ofir Balassiano & Ofir Shaty on November 12, 2024 - ModeLeak: Privilege Escalation to LLM Model Exfiltration in Vertex AI https://unit42.paloaltonetworks.com/privilege-escalation-llm-model-exfil-vertex-ai/ . Guess what, it still works. Google marked my report “Won’t Fix Infeasible ” for lacking a “reproducible proof of concept” on a report that is mostly reproducible proof of concept. the one permission Vertex AI custom jobs are simple: hand Google a container, Google runs it. The catch is who it runs as. By default that’s a Google-managed identity: service-