A vulnerability in the Google Cloud Vertex AI SDK allowed attackers to replace machine learning models with malicious code. Fixed in version 1.148.0. Find out what this means for your AI infrastructure.
What Happened
Researchers from the Unit 42 (Palo Alto Networks) discovered a critical vulnerability in the Google Cloud Vertex AI Python SDK (google-cloud-aiplatform) that could have allowed attackers to take control of uploaded machine learning models and execute malicious code in the victim’s environment. The vulnerability was reported through the Google Vulnerability Reward Program and fully patched in version 1.148.0, released on April 15, 2026.
The issue affected SDK versions 1.139.0 and 1.140.0 and arose from a combination of two flaws: predictable naming of cloud storage buckets (GCS buckets) and a lack of bucket ownership verification. An attacker could thus exploit this vulnerability without having any access to the victim’s cloud project.
How the Attack Worked
The researchers named the attack “Pickle in the Middle”—it exploits Python’s deserialization of the pickle format to execute malicious code. The attack unfolded in several steps:
- The attacker predicted the name of the victim’s default bucket in advance and created it in their own project with unrestricted access rights (bucket squatting),
- when uploading the model, the SDK unknowingly sent the artifacts to the attacker’s infrastructure,
- a malicious cloud function detected the upload and, within 2.5 seconds, replaced the model file with a poisoned version,
- when loading the model via pickle deserialization, attacker-controlled code was executed directly within the Vertex AI environment.
A successful exploit allowed the attacker to extract service account tokens, access other models in the same environment, enumerate BigQuery datasets, and gather information about the internal infrastructure from cloud logs. The compromised credentials had a wide range of permissions, which significantly increased the attack’s impact.
Who Was Affected
The vulnerability affected organizations using the Vertex AI Python SDK versions 1.139.0 and 1.140.0 that did not use an explicitly defined staging bucket when uploading models—that is, they relied on an automatically generated default name. Vertex AI is a widely used platform for building and deploying machine learning models in enterprise environments.
Security experts point out that this vulnerability exemplifies a new type of risk in the AI/ML pipeline—supply chain attacks no longer target only software components but directly target model artifacts.
What to Do
Google has released a two-step fix—first by implementing random bucket naming using UUIDs, and then by adding explicit ownership verification. We recommend:
- upgrade the Google Cloud AI Platform SDK to version 1.148.0 or later,
- explicitly define a staging bucket instead of relying on default values,
- monitor the integrity of models during upload and deployment,
- implement stricter controls over cloud storage, identity, and model validation.
OUR SERVICES
Source: Cyber Security News
