Mitre Atlas: AML.T0110.002 | Detection.FYI

First Time GCP Vertex AI Agent Engine Sandbox Code Execution by User and Source ASN

Oct 7, 2026 · Domain: GenAI Domain: Cloud Data Source: GCP Vertex AI Data Source: GCP Data Source: Google Cloud Platform Platform: GCP Service: GCP Vertex AI Use Case: Threat Detection Tactic: Execution Threat: Unauthorized AI Usage Mitre Atlas: AML.T0053 Mitre Atlas: AML.T0110 Mitre Atlas: AML.T0110.002 Resources: Investigation Guide Rule Type: New Terms ·
Share on:

Detects the first time a Vertex AI Agent Engine caller executes code in a sandboxEnvironment from a given source autonomous system. First-time sandbox execution by a user and source ASN can indicate a new workload, stolen credentials used from an unusual network, or early Agent Engine abuse before broader sandbox reuse is visible.

Read More