Vulnerability in Google Cloud Vertex AI SDK for Python: a threat to the security of AI models

A team of researchers has discovered a critical vulnerability in the Google Cloud Vertex AI Software Development Kit (SDK) for Python, which would have allowed an attacker to compromise users' artificial intelligence models. Before Google released a patch, this vulnerability would have allowed an aggressor to operate from their own Google Cloud project to hijack the loading of a victim's model and poison it.

Attack Mechanism

The attack exploits a combination of a predictable default bucket name and the lack of ownership control in the SDK. When a Vertex AI user uploads a model without specifying a custom staging bucket, the SDK builds a bucket name using a deterministic model based on the project ID and region.

An attacker who knows the victim's project ID can pre-create this bucket in their own project, a technique known as "bucket squatting". The SDK then silently uploads the victim's model artifacts to the bucket controlled by the attacker. Subsequently, within a very narrow window of opportunity, the attacker replaces the legitimate model with one containing a malicious payload. Once the victim deploys the compromised model, the attacker's code is executed.

Consequences of the Vulnerability

This vulnerability could lead to serious consequences, including data exfiltration, lateral movement, and further compromise of the victim's cloud environment. The attack has been dubbed "Pickle in the Middle" because it exploits the deserialization mechanism of the pickle module integrated in Python.

Technical Details

The vulnerability was found in versions 1.139.0 and 1.140.0 of the google-cloud-aiplatform SDK. The vulnerable code was found in the file gcsutils.py, within the function stagelocaldatain_gcs(). This function builds the bucket name deterministically from the project ID and region.

The function only checks the existence of the bucket, not the ownership. If the bucket exists, even in a completely different project, the SDK proceeds to upload the model artifacts without further checks. The attacker has a window of about 2.5 seconds to replace the model with a compromised one.

Recommendations and Solutions

The researchers reported the vulnerability to Google's security team, which accepted their conclusions. The patch to fix this issue was released in version 1.148.0 of the SDK, published on April 15, 2026. Developers are advised to update to the correct versions of the SDK.

To identify and mitigate complex risks specific to AI, you can use the Unit 42 AI Security Assessment and the Unit 42 Frontier AI Defense service. In case of suspected compromise or urgent issues, you can contact the Unit 42 incident response team.

This discovery underscores the importance of implementing rigorous security controls in cloud services and keeping the SDKs used for AI application development up to date. Developers must be aware of the risks associated with using default staging buckets and consider implementing custom buckets to enhance the security of their models.

Impact on the AI Security Landscape

This vulnerability represents a emblematic case of the emerging challenges in the security of cloud-native AI infrastructures. According to data from the Unit 42 AI Security Assessment, 68% of organizations using cloud AI platforms have experienced at least one security incident related to misconfigured storage buckets in the last 12 months.

The discovery takes on particular relevance in a context where the global market for AI services is expected to grow by 28% annually, with an increasing focus on the adoption of edge computing solutions. This trend increases the surface exposure of AI assets, making the implementation of preventive security controls critical.

Analysis of the Window of Opportunity

The 2.5-second time window for the exfiltration of the compromised model requires careful analysis. Researchers have discovered that this window can be extended to 7-10 seconds under conditions of high latency, a common situation in multi-cloud environments or with geographically distributed connections.

This additional time factor significantly increases the attack vector, allowing attackers to implement more complex payloads or to coordinate synchronized attacks on multiple models simultaneously.

Implications for Enterprise Adoption

Enterprise AI adoption is growing rapidly, with forecasts indicating a 350% increase in the next 3 years. However, this vulnerability highlights the importance of adopting a "security by design" approach in the development of AI applications.

According to the Unit 42 Frontier AI Defense, organizations should implement:

  • Custom staging buckets with restrictive access policies
  • Continuous monitoring of storage bucket accesses
  • Pre-deployment model validation with sandboxing

Advanced Mitigation Strategies

1. Defensive Deployment Models: Implement deployment patterns that isolate models in containers with minimal privileges

2. Behavioral Monitoring: Use solutions like Cortex XDR to detect anomalous activity in deployed models

3. Automated Audits: Configure CI/CD pipelines that verify model integrity before deployment

Attack Case Study

The research team simulated a test attack that demonstrated the feasibility of:

  • Extracting sensitive data from the model's execution context
  • Performing lateral movement within the victim's cloud infrastructure
  • Maintaining persistence through compromised models

For further technical details, consult the official Vertex AI documentation.

Additional Resources

To delve deeper into AI security techniques, it is recommended to consult:

In case of security emergencies, the Unit 42 incident response team is available 24/7.

Editorial Note and Disclaimer

The guides and content published on GoYou are the result of independent research and analysis activities, for informational, educational, and in-depth purposes.

GoYou does not constitute a journalistic publication or an editorial product pursuant to Law No. 62/2001 and does not provide real-time information.

The GoYou project does not provide professional, technical, legal, or financial advice and disclaims any liability for the misuse of the information published.

In the Crypto sector, every investment involves risks: the reader is invited to always inform themselves independently before making any decision.