Google Cloud Vertex AI Vulnerability Lets Attackers Take Over and Poison AI Models

A critical vulnerability in Google Cloud’s Vertex AI has been discovered, allowing attackers to hijack machine learning model uploads, poison artifacts, and achieve cross-tenant remote code execution (RCE) without any prior access to the victim’s environment.

Dubbed “Pickle in the Middle” by researchers from Palo Alto Networks’ Unit 42, this flaw affects the Python SDK (google-cloud-aiplatform). It combines predictable cloud resource naming, bucket squatting, and unsafe deserialization, creating a significant security risk.

Google Cloud Vertex AI Vulnerability

Vertex AI is widely used for building and deploying machine learning models, with its Model Registry relying on Google Cloud Storage (GCS) buckets to stage artifacts before deployment.

The vulnerability arises because the SDK automatically generates a default staging bucket name using a deterministic format based on the project ID and region.

Importantly, affected versions (1.139.0 and 1.140.0) only check whether a bucket exists, rather than verifying whether it belongs to the correct project. This oversight allows attackers to pre-create these predictable buckets in their own projects, a tactic known as bucket squatting.

The attack proceeds in six phases:

1. Phase 1: The attacker predicts the victim’s staging bucket name and creates it in their own Google Cloud project, setting permissive IAM roles to allow external interaction. Because bucket names are globally unique, the victim’s SDK unknowingly interacts with the attacker’s bucket.

2. Phase 2: The attacker deploys a malicious Cloud Function that is triggered by object creation events in the bucket. This function monitors uploads and quickly replaces legitimate model files with malicious payloads. Timing is crucial, as it relies on a narrow race-condition window of about 2.5 seconds between upload and processing.

3. Phase 3: The victim uploads a model using standard SDK operations without specifying a custom staging bucket. The SDK resolves the bucket name, finds that it exists, and uploads model artifacts directly to the attacker’s bucket.

4. Phase 4: The attacker’s Cloud Function triggers immediately upon upload and replaces the legitimate model (typically serialized via joblib or pickle) with a malicious version within milliseconds. Since the Vertex AI service agent has not yet accessed the artifact, the attacker successfully swaps the file before it is consumed.

5. Phase 5: The victim deploys the model to a Vertex AI endpoint. With no integrity checks on the staged artifacts, the poisoned model is treated as legitimate and loaded into the serving infrastructure.

6. Phase 6: Remote code execution occurs during model deserialization. The exploit exploits Python’s pickle mechanism, specifically the `_reduce_` method, which allows arbitrary code execution when the model is loaded via joblib.load(). In the proof-of-concept, this led to the exfiltration of OAuth tokens from the Google-managed service account, granting access to sensitive resources, including other model artifacts, BigQuery metadata, and internal tenant infrastructure.

The impact extends beyond a single deployment. Researchers have demonstrated cross-deployment data access, model theft, and reconnaissance capabilities using the compromised service account token, which had broad cloud-platform scope. This effectively undermines assumptions about tenant isolation in Vertex AI’s managed environment.

Google has since addressed the issue. Fixes introduced in versions 1.144.0 and 1.148.0 include randomized bucket naming using UUIDs and explicit ownership verification checks before using existing buckets. The vulnerability was reported on March 5, 2026, and patches were fully deployed by April 15, 2026.

Security experts strongly recommend upgrading to the patched SDK versions and explicitly defining staging buckets to avoid falling back to default naming. This incident underscores the growing security risks in AI and ML pipelines, where traditional cloud misconfigurations intersect with model serialization, creating new and powerful attack vectors.

CISO & Security Leaders: Your next breach may not have a face. Join ISC2’s LIVE webinar, “Ghost in the Machine”