Detects the first time in 14 days that a Vertex AI caller (user or service account) runs model inference (GenerateContent, StreamGenerateContent, Predict, or RawPredict) from a source autonomous system (ASN). Stolen Google Cloud credentials, including exported service account keys and OAuth tokens, are used for LLMjacking from attacker infrastructure, which shows up as the victim identity calling models from a hosting provider, VPN, or residential proxy network it has never used before.

Read More

Identifies an IAM policy change on a Google Cloud project, folder, or organization that grants a Vertex AI role (roles/aiplatform.*) to a principal. Vertex AI roles control who can invoke models, deploy endpoints, run agents, and read prompt and training data. An adversary who has gained IAM administration rights can grant a Vertex AI role to an identity they control to keep model access after the original foothold is removed, or to run LLMjacking workloads under the victim's billing. Google-managed service agent roles are excluded because Google grants them automatically when the API is enabled.

Read More

Detects the first time a Vertex AI Agent Engine caller executes code in a sandboxEnvironment from a given source autonomous system. First-time sandbox execution by a user and source ASN can indicate a new workload, stolen credentials used from an unusual network, or early Agent Engine abuse before broader sandbox reuse is visible.

Read More

Detects Vertex AI authenticated caller activity for the same client.user.email from at least three countries and three source IPs within a four-hour interval. That pattern can indicate stolen user or service-account credentials reused from multiple regions, including VPN or cloud egress and return trips where first and last locations are close.

Read More

Detects the same Vertex AI authenticated caller (client.user.email) generating aiplatform audit activity from geographically distant source IPs within a short window at an impossible travel speed. That pattern can indicate a stolen user or service-account credential used from multiple regions. Related: GCP Vertex AI Caller Activity From High Number of Countries covers slower multi-country reuse without a high-speed hop.

Read More

Detects Vertex AI prompt-response logs where a candidate safety_ratings.probability is HIGH or MEDIUM. Those values are stronger signals than NEGLIGIBLE or LOW alone. Requires the request to include safetySettings so ratings are logged.

Read More

Detects a single source IP making a high number of Vertex AI GenerateContent (or StreamGenerateContent) audit calls against the same model resource in the lookback window. That pattern fits model extraction, automated scraping, or a compromised caller burning prediction quota.

Read More

Detects a high number of Vertex AI prompt-response log rows and high total token usage for one model in the lookback window. Totals use provider usage_metadata.total_token_count (includes thinking tokens when billed). High request and token volume can indicate model extraction, quota abuse, or a compromised caller. Tune thresholds for your baseline.

Read More

Detects Vertex AI GenerateContent prompts that match common jailbreak / instruction-override heuristics (for example ignore previous instructions, DAN or developer mode, unrestricted-AI language, or explicit safety-filter bypass). Typical prompt_response_logs exports do not populate HARM_CATEGORY_JAILBREAK (unlike hate/harassment/dangerous ratings); Model Armor findings remain the preferred first-party jailbreak signal when that API is enabled.

Read More

Detects a GCP Vertex AI GenerateContent exchange whose prompt or model reply contains a known credential pattern (AWS access keys, GitHub tokens, PEM private keys, and similar), or whose assistant reply warns about exposed keys and revocation. Secrets in prompt/response logs are visible to anyone with access to BigQuery prompt-response export and Elastic.

Read More

Detects changes to Vertex AI publisher model configuration via SetPublisherModelConfig (for example enabling or retargeting prompt/response BigQuery logging). Unexpected config changes can disable security-relevant logging or redirect logs.

Read More

Detects three or more Vertex AI GenerateContent replies in 60 minutes whose assistant text indicates a refusal (cannot fulfill/assist/help/answer, unable to assist, decline the request, against my guidelines, and similar), aggregated by project and model. Prompt-response logs lack a stable caller identity, so this is a project-wide refusal burst signal — pivot to auditlogs for principal/IP attribution.

Read More

Detects Vertex AI GenerateContent responses whose candidate finish_reason is SAFETY. That value is emitted when Gemini safety filters stop generation. Unlike textual refusals (finish_reason STOP), SAFETY means the provider blocked or truncated the completion.

Read More

Detects Vertex AI GenerateContent requests that set safety_settings.threshold to BLOCK_NONE. That threshold disables category blocking for the listed harm categories when clients explicitly send safetySettings. Attackers and careless apps use BLOCK_NONE to weaken built-in Gemini filters.

Read More