Back Ground.News

Google Vertex AI SDK Flaw Let Attackers Hijack Model Uploads via Bucket Squatting

Ground.News • June 17, 2026

A design flaw in the Vertex AI software development kit (SDK) for Python, Google Cloud’s managed platform for building, training, and deploying AI agents, could allow hijacking and poisoning of models outside of a developer’s own Google Cloud project. According to Unit 42 researchers, a combination of bad bucket naming logic and missing authentication made it possible for an attacker to hijack the victim’s project by just knowing their project I…

A vulnerability in the Google Vertex AI SDK allows attackers to preemptively hijack model uploads via a storage bucket.

A flaw in the Google Cloud Vertex AI SDK for Python let an attacker with no access to a victim's project hijack the victim's machine learning model upload and run code inside Google's serving infrastructure. Palo Alto Networks Unit 42, which found and reported the bug through Google's bug bounty program, calls the technique "Pickle in the Middle" and said it saw no exploitation in the wild.

To view factuality data please Upgrade to Premium

To view ownership data please Upgrade to Vantage

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Google Vertex AI SDK Vulnerability Enables Code Execution via Bucket Squatting A vulnerability in Google's Vertex AI SDK for Python allowed attackers to hijack machine learning model uploads and execute arbitrary code within Google's infrastructure. Discovered by Palo Alto Networks' Unit 42, the flaw, termed 'Pickle in the Middle,' exploited predictable bucket naming and a lack of ownership verification. Attackers could create a bucket with the same name as a victim's expected staging bucket, leading to model uploads being redirected to the attacker's bucket. This scenario allowed the attacker to replace the model with a malicious version during a narrow time window. The exploit could lead to remote code execution due to the use of Python's pickle serialization format. Google has patched the vulnerability in SDK versions 1.144.0 and 1.148.0, urging users to update. No active exploitation has been reported in the wild. 8 sources 65

Extracted Entities

Google Vertex AI SDK Flaw Let Attackers Hijack Model Uploads via Bucket Squatting

The full story

Extracted Entities

CWE Weaknesses (1)

Platforms (1)

Tools (2)

Vulnerabilities (1)