Tenable Study Warns of AI Configuration Vulnerabilities in Cloud Services
A Tenable study identified widespread configuration vulnerabilities in cloud AI services from major providers, where 77 percent of organizations using Google Cloud Platform's Vertex AI have excessive privilege settings. The report warns that three-quarters of cloud AI workloads carry unpatched critical vulnerabilities that could expose confidential data and models to manipulation and theft.
What happened
A 2025 Tenable study examined AI services offered by Amazon Web Services, Google Cloud Platform, and Microsoft Azure, identifying configuration vulnerabilities termed the 'Jenga effect'—where misconfigured cloud services create cascading risks across layered systems.
The study found that 77 percent of organizations have Google Cloud Platform's Compute Engine default service account configured with excessive privileges in Vertex AI Workbench notebook instances, and three of every four cloud workloads using AI have at least one unpatched critical vulnerability.
Reported impact
Cloud-based AI systems with configuration errors are vulnerable to data manipulation, tampering, and leaks. The misconfigurations create what the study describes as avoidable toxic combinations that leave confidential AI data and models at risk.
Index analysis
According to the Tenable report, 77 percent of cybersecurity professionals in Mexico identified the cloud as the primary risk vector for their organizations.
Governance controls
Tenable's director general for Mexico stated that Mexican organizations should evolve their cybersecurity strategy from reactive approaches to continuous exposure management to anticipate risks before they impact business operations.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.