Google Vertex AI SDK Flaw Let Attackers Hijack Model Uploads via Bucket Squatting

What happened

A vulnerability in the Google Cloud Vertex AI SDK for Python allowed attackers with no access rights to a victim’s project to hijack machine learning model uploads. The flaw enabled attackers to execute arbitrary code inside Google’s model serving infrastructure by exploiting a technique researchers named “Pickle in the Middle.” Palo Alto Networks’ Unit 42 discovered and reported the issue through Google’s bug bounty program. According to Unit 42, there is no evidence this flaw has been exploited in the wild.

The risk

This vulnerability puts the integrity of ML deployments at risk, particularly for organizations hosting sensitive or proprietary models. Attackers could intercept and replace legitimate model uploads with malicious payloads during the upload process. This breaks the assumed trust boundary of the cloud provider’s serving environment, exposing it to unauthorized code execution. The flaw bypasses normal access controls since it does not require authentication or project privileges.

Why it matters

Vertex AI is a go-to platform for building and deploying machine learning models at scale. A flaw that lets outsiders hijack model uploads can undermine confidence in the platform’s security guarantees. For users, this raises the operational risk of model supply chain attacks where compromised models could undermine AI outcomes or leak data. Cloud operators and compliance teams now face pressure to reassess their monitoring and trust assumptions around model upload workflows on public cloud platforms.

Who should pay attention

Developers, data scientists, and MLops specialists relying on Vertex AI SDK need to update to patched versions immediately and scrutinize their model upload security practices. Security teams at enterprises using Vertex AI should incorporate this risk into their threat models and cloud security audits. Cloud providers must strengthen validation and sandboxing of uploaded models to prevent similar escalation routes in AI infrastructure.

What to watch next

It will be important to track if this vulnerability leads to broader cloud ML supply chain scrutiny and tighter security controls industrywide. Google’s ongoing response and patch rollout timeline will set a precedent for handling AI platform threats. On the attacker front, researchers and operators should watch for any attempts to weaponize this or related SDK vulnerabilities in other cloud AI stacks.

AI Quick Briefs Editorial Desk