Critical Google Cloud Vertex AI Vulnerability Lets Attackers Hijack AI Models

Key Takeaways

• A critical vulnerability in Google Cloud Vertex AI’s Python SDK allowed attackers to hijack machine learning model uploads.
• The flaw, affecting versions 1.139.0 and 1.140.0, enabled remote code execution (RCE) and model poisoning without requiring initial access to victim cloud projects.
• The issue stemmed from predictable cloud storage bucket naming and a lack of ownership validation during model staging.
• Google swiftly patched the vulnerability, fully resolving it in version 1.148.0, released on April 15, 2026.

A significant security flaw within Google Cloud’s Vertex AI platform could have allowed malicious actors to compromise machine learning models and execute arbitrary code within victim environments. This vulnerability, uncovered and reported by cybersecurity researchers, highlighted critical weaknesses in the platform’s model upload mechanism.

The core problem resided within the Vertex AI Python SDK (google-cloud-aiplatform), specifically due to a combination of easily predictable naming conventions for cloud storage buckets and insufficient validation of bucket ownership. This oversight created an avenue for sophisticated supply chain-style attacks targeting AI/ML pipelines.

Researchers from Unit42 confirmed that Vertex AI versions 1.139.0 and 1.140.0 were susceptible to these attacks, which could lead to model poisoning and remote code execution. Crucially, these exploits could be launched without an attacker needing any prior access to the target’s cloud project.

Vertex AI is a widely utilized service for developing, training, and deploying machine learning models. During the model upload process via the SDK, model artifacts are temporarily stored in a Google Cloud Storage (GCS) bucket before their final deployment.

The “Pickle in the Middle” Attack Chain

The vulnerability manifested when developers did not explicitly specify a staging bucket for their model artifacts. In such cases, the SDK would automatically generate a bucket name following a predictable pattern. The critical flaw was that the SDK only checked for the existence of this bucket, failing to verify if it belonged to the legitimate project. This allowed for a technique known as “bucket squatting.”

In a bucket squatting scenario, an attacker could preemptively create a GCS bucket with the expected, predictable name within their own cloud project. When a victim subsequently initiated a model upload without specifying a staging bucket, their model artifacts would be unknowingly directed and uploaded to the attacker-controlled bucket.

Unit42 researchers dubbed their exploitation method “Pickle in the Middle,” a reference to Python’s pickle deserialization mechanism, which was leveraged to achieve code execution. The attack unfolded in several distinct phases:

• An attacker would anticipate the victim’s default bucket name and then create an identically named bucket in their own project, configuring it with permissive access controls.
• When the victim uploaded a model, the Vertex AI SDK would inadvertently send the model artifacts to the attacker’s compromised bucket.
• A malicious cloud function, pre-configured by the attacker, would detect the new upload and swiftly replace the legitimate model file with a poisoned version within milliseconds.
• Subsequently, the Vertex AI infrastructure would proceed to deploy this malicious, poisoned model.
• During the model loading phase, the pickle deserialization process would then execute the attacker-controlled code embedded within the poisoned model.

This entire process required precise timing, occurring within a narrow race window of approximately 2.5 seconds. This allowed the attacker sufficient time to swap the model before Google’s service agent consumed the original, legitimate artifact.

Successful exploitation of this flaw granted attackers full remote code execution capabilities within the Vertex AI serving environments. Proof-of-concept testing demonstrated that attackers could perform several high-impact actions, including:

• Extracting sensitive service account tokens from the metadata server.
• Accessing other models residing within the same tenant environment.
• Enumerating BigQuery datasets and associated permissions.
• Gathering internal infrastructure details from cloud logs.

The compromised credentials often carried broad cloud-platform scope, significantly amplifying the potential blast radius of any successful attack.

According to Unit 42 researchers at Palo Alto Networks, the root cause of the vulnerability was traced to the SDK’s staging logic within the gcs_utils.py module. This module was responsible for generating predictable bucket names and performing only a superficial existence check, completely omitting ownership verification. This design flaw effectively shattered isolation between tenants, enabling cross-project resource abuse.

Fix and Mitigation

Google responded promptly to the disclosure, implementing multiple updates to address the critical vulnerability. The initial fix introduced randomized bucket naming using Universally Unique Identifiers (UUIDs), significantly complicating prediction. A subsequent patch further bolstered security by adding explicit bucket ownership verification to prevent squatting attempts.

The vulnerabilities were comprehensively resolved in version 1.148.0 of the Google Cloud AI Platform SDK, which was released on April 15, 2026. The issue was reported through Google’s Vulnerability Reward Program and was assigned a high severity rating. Google deployed fixes rapidly following the initial disclosure in March 2026.

This incident serves as a stark reminder of the evolving threat landscape in AI/ML pipelines, where supply chain-style attacks can target model artifacts directly. Security experts emphasize the need for organizations leveraging managed AI platforms to implement more stringent controls over storage, identity management, and model validation processes to counteract similar emerging threats.

What You Should Do

• Immediately upgrade your Google Cloud AI Platform SDK (google-cloud-aiplatform) to version 1.148.0 or later to ensure all known vulnerabilities are patched.
• Always explicitly define and specify your staging buckets when uploading models, rather than relying on the SDK’s default, automatically generated bucket names.
• Implement robust monitoring and integrity checks throughout your model upload and deployment workflows to detect any unauthorized modifications or diversions of model artifacts.
• Regularly audit access controls for your Google Cloud Storage buckets and ensure the principle of least privilege is applied to service accounts and users interacting with Vertex AI.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.