Pickle in the Middle: Vertex AI SDK Flaw Let Attackers Hijack AI Models and Steal Cloud Credentials

Researchers at Palo Alto Networks Unit 42 have disclosed a vulnerability in the Google Cloud Vertex AI Python SDK that allowed an attacker with no foothold in a victim's environment to intercept machine learning model uploads and execute arbitrary code inside Google's serving infrastructure. The technique, which Unit 42 has named Pickle in the Middle, exploits a predictable bucket naming flaw in the SDK and represents the second bucket squatting vulnerability to surface in Vertex AI within 2026 alone.

The flaw was discovered by Unit 42 researchers and reported to Google through the Vulnerability Reward Programme on 5 March 2026. Google shipped an initial partial fix in SDK version 1.144.0 on 31 March, and completed the remediation in version 1.148.0 on 15 April 2026, which adds explicit bucket ownership verification to the model upload function. No exploitation in the wild has been identified by either Unit 42 or Google. All organisations running the Vertex AI Python SDK should update to version 1.148.0 or later immediately.

The root cause sits in how the Vertex AI SDK selects a temporary Cloud Storage staging bucket when a user uploads a model. If the developer does not explicitly set a staging bucket, the SDK generates a predictable bucket name derived from the project ID and region, following a pattern such as project-vertex-staging-region. The SDK then checks whether that bucket exists, but it does not verify ownership. Because Cloud Storage bucket names are globally unique, any attacker who knows or can discover a victim's project ID, which is frequently public, can pre-register the expected bucket name in their own Google Cloud project before the victim uploads a model.

When the victim's SDK then attempts to upload model files, they are silently routed to the attacker's bucket instead of a bucket the victim controls. The attacker can then swap the legitimate model files for a malicious replacement before Vertex AI reads and loads them for serving.

The exploitation window is narrow but achievable. Unit 42 measured approximately 2.5 seconds between a victim's model upload and Vertex AI reading the file. In their proof of concept, the attacker used a Cloud Function that triggered on upload and replaced the model file in 1.4 seconds, leaving Vertex AI to load the malicious version. The payload executed inside the Vertex AI serving container and stole an OAuth token from the container's metadata server. In Unit 42's test environment, that token provided access beyond the single compromised deployment, exposing other model artefacts in the same Google-managed tenant project, BigQuery metadata, access control lists, tenant logs, GKE cluster names, and internal container image paths.

The attack has two prerequisite conditions. The victim's default staging bucket must not already exist in the target region, which is common for new Vertex AI deployments. And the developer must be relying on the SDK default rather than specifying an explicit staging bucket. Both conditions are common in development and CI pipeline environments where teams spin up new Vertex AI projects frequently.

This is the second predictable-bucket-name vulnerability to affect Vertex AI in 2026. Google patched CVE-2026-2473 in February, a separate bucket squatting flaw in Vertex AI Experiments that also permitted cross-tenant code execution, model theft, and model poisoning. The recurrence of the same class of vulnerability within a single year on the same platform warrants heightened attention from any organisation running ML workloads on GCP, particularly those in Saudi Arabia and the UAE where Vertex AI adoption is accelerating alongside government and enterprise AI programme rollouts.

For enterprise security and DevSecOps teams, the immediate remediation actions are clear. Update the google-cloud-aiplatform Python SDK to version 1.148.0 or later across all environments where it runs, including notebooks, CI jobs, training pipelines, and production services, since the vulnerable logic lives in the client SDK rather than in the cloud infrastructure itself. Set an explicit staging bucket parameter pointing to a Cloud Storage location your organisation controls on every model upload. Audit all Google Cloud project IDs that appear in public repositories, documentation, or deployment scripts, as project ID exposure is the enabler of the pre-registration attack.

The broader lesson is structural. As AI model supply chains extend across cloud platforms, third-party SDKs, and automated pipelines, the attack surface for AI workload compromise expands in ways that traditional perimeter and application security models do not fully address. The connection to the Agentjacking attack class disclosed earlier this week is direct: in both cases, a trusted AI platform or toolchain becomes the vector. The assets being targeted are not databases or endpoints but the AI models themselves, the credentials that serve them, and the infrastructure intelligence those credentials can unlock.