Agents of Chaos: GCP Service Agents - BSides Las Vegas 2026
BSides Las Vegas 2026 — speaker not captured
A systemic audit of the service accounts Google Cloud creates on your behalf — the ones you never provisioned and therefore never reviewed.
Photos only — this session was not recorded, and the full title was truncated on screen. I caught two views of the tool demo; notes below cover only those.
The Dataset
The research is backed by a browsable graph called AgentMap, and the numbers give the shape of the problem: 153 services, 200 agents, 133 dependencies, 4,353 permissions.
The legend is where the security content sits. Nodes are services or service agents; edges are primary or secondary dependencies; and a warning marker flags agents that hold escalation-relevant permissions. Enabling a service quietly creates an identity, gives it a Google-defined role, and wires it to other services — none of which shows up in the IAM policy you wrote.
Following One Agent
Expanding a single agent makes the point better than any statistic. roles/apigee.serviceAgent fans out to API Hub, IAM, logging, monitoring, Cloud Trace and telemetry — and IAM carries the escalation marker.
That is one agent of two hundred. The systemic argument is that these dependencies were designed service by service, and nobody owns the graph they add up to.
The tool is published as a static site, filterable by service or by dependency.
Frequently Asked Questions
What are GCP service agents?
Google-managed service accounts that Google Cloud services use to act on your behalf. They are created automatically, carry Google-defined roles, and are easy to overlook precisely because you never provisioned them yourself.
How large is the GCP service agent surface?
The AgentMap dataset shown in the talk covers 153 services, 200 agents, 133 dependencies and 4,353 permissions, flagging which agents hold escalation-relevant rights.
Where can I explore the data?
AgentMap is published as a browsable graph, filterable by service or by dependency, showing primary and secondary edges between services and the agents that reach them.