- Joined
- Jan 20, 2026
- Messages
- 345
- Reaction score
- 2,423
The routine operation opened the way where no one called strangers.
Cloud machine learning services often hide a complex infrastructure behind multiple lines of code, and this is the kind of automation that created a dangerous error in Google Vertex AI SDK for Python. Palo Alto Networks Unit 42 identified a vulnerability that allowed the outside to intercept the model load and start the code inside the infrastructure of Google, which serves the models.
The problem arose when the developer did not specify its own intermediate Cloud Storage for the model loading. SDK itself created the name of the repository according to a predictable scheme from the project identifier and the region, then checked only the presence of a tank, but not the owner. Since the names of the tanks in Cloud Storage are globally unique, the attacker could create the right storage in advance in his project.
After such a substitution, the victim’s SDK sent the model files to someone else’s tank. Then the attacker quickly replaced the loaded model with a malicious version. The risk has amplified the popular method of saving models in Python through pickle and joblib: such files can execute code when downloading and desed serialization, if the file contains malicious logic.
Unit 42 tested the script in the test environment. Between downloading the model and reading the Vertex AI file was about 2.5 seconds. In the demonstration, Cloud Function worked after booting and replaced the model in 1.4 seconds, that is, before Vertex AI managed to read the original file. After launch, the switched model stole an OAuth token from the metadata server of the service container.
In the test, the resulting token opened access not only to the compromised deployment of the model. Through it, it was possible to obtain information about other artifacts of models in the same project running Google, including the TensorFlow model with trained scales, BigQuery metadata, access lists, magazines, GKE cluster names and internal tracks of container images. Unit 42 found no signs of real attacks.
The attack worked only under two conditions: the standard intermediate victimage tank did not yet exist in the selected region, and the staging_bucket parameter remained empty. Google received a report on March 5, 2026, added a random uid4 to the names of the bakets in version 1.144.0 of March 31 and completed the corrigation in version 1.148.0 of April 15, where the check of the owner of the tank in Model.upload() appeared.
Users of Google Vertex AI SDK for Python are encouraged to update google-cloud-aipplform to version 1.148.0 or newer, explicitly set staging_bucket in controlled Cloud Storage and checking SDK versions where the library is launched, including interactive environments, CI-tasks and model learning processes.
Cloud machine learning services often hide a complex infrastructure behind multiple lines of code, and this is the kind of automation that created a dangerous error in Google Vertex AI SDK for Python. Palo Alto Networks Unit 42 identified a vulnerability that allowed the outside to intercept the model load and start the code inside the infrastructure of Google, which serves the models.
The problem arose when the developer did not specify its own intermediate Cloud Storage for the model loading. SDK itself created the name of the repository according to a predictable scheme from the project identifier and the region, then checked only the presence of a tank, but not the owner. Since the names of the tanks in Cloud Storage are globally unique, the attacker could create the right storage in advance in his project.
After such a substitution, the victim’s SDK sent the model files to someone else’s tank. Then the attacker quickly replaced the loaded model with a malicious version. The risk has amplified the popular method of saving models in Python through pickle and joblib: such files can execute code when downloading and desed serialization, if the file contains malicious logic.
Unit 42 tested the script in the test environment. Between downloading the model and reading the Vertex AI file was about 2.5 seconds. In the demonstration, Cloud Function worked after booting and replaced the model in 1.4 seconds, that is, before Vertex AI managed to read the original file. After launch, the switched model stole an OAuth token from the metadata server of the service container.
In the test, the resulting token opened access not only to the compromised deployment of the model. Through it, it was possible to obtain information about other artifacts of models in the same project running Google, including the TensorFlow model with trained scales, BigQuery metadata, access lists, magazines, GKE cluster names and internal tracks of container images. Unit 42 found no signs of real attacks.
The attack worked only under two conditions: the standard intermediate victimage tank did not yet exist in the selected region, and the staging_bucket parameter remained empty. Google received a report on March 5, 2026, added a random uid4 to the names of the bakets in version 1.144.0 of March 31 and completed the corrigation in version 1.148.0 of April 15, where the check of the owner of the tank in Model.upload() appeared.
Users of Google Vertex AI SDK for Python are encouraged to update google-cloud-aipplform to version 1.148.0 or newer, explicitly set staging_bucket in controlled Cloud Storage and checking SDK versions where the library is launched, including interactive environments, CI-tasks and model learning processes.
