Researchers hijack the API response channel of the Vertex AI Agent Engine sandbox; Google rules it Won't Fix

Security researchers disclosed that the sandbox of Google's Gemini Enterprise Agent Platform (formerly Vertex AI Agent Engine) has a response channel hijacking issue: user-submitted Python code runs directly via exec() inside the PID 1 orchestration process, sharing address space and file descriptors with the orchestrator, so it can rewrite GOT entries in libpython3.12.so.1.0, hook the outbound response pipe on fd=5 and the inbound code pipe on fd=6. A single execute_code() call can permanently replace all subsequent API responses from that sandbox and rewrite submitted code after the API-layer content policy passes but before exec() executes. The author demonstrated end-to-end that a code security review agent returns SAFE — Approve for deployment for code containing four security violations, while the underlying analysis actually correctly identified all the issues. The author recommends isolating the orchestrator from user code at the process boundary and signing sandbox responses.