Document Agent Identity credential vault attack paths

[carlospolop]

Summary

• document direct API-key/OAuth-token retrieval through agentidentity.authProviders.retrieveCredentials
• document 3LO token-endpoint replacement through agentidentity.authProviders.update
• add no-list known-name enumeration and strict Workspace scope/consent caveats

Live validation

Tested in authorized project gcp-labs-ly3gvnn7 on 2026-09-08 with synthetic secrets only.

• retrieve-only service account: provider GET/LIST returned 403; credential retrieval returned the exact synthetic API key and, for the exact case-sensitive user ID, the OAuth access token finalized by a different principal
• update-only service account: provider GET/LIST/retrieve returned 403; a token-URL-only patch succeeded; the next legitimate refresh delivered the exact synthetic refresh token, client ID, and client secret to the replacement endpoint
• wrong/differently-cased 3LO user IDs required a new consent flow
• no real Workspace OAuth token or Workspace data was used

All test authorizations were revoked. Providers were soft-deleted, and all service accounts, custom roles, IAM bindings, Cloud Run services, container images, build-source objects, and temporary API enablements were removed.

Validation

• all seven official Google documentation links return HTTP 200
• git diff --check passes