Pickle in the Middle: Vertex AI Bucket-Squatting Bug Lets Attackers Swap Models
A security flaw in Google Cloud Vertex AI's Python SDK allowed an attacker with their own Google Cloud project to hijack a victim's model upload by pre-creating a predictable staging bucket and swapping the uploaded model before Vertex AI reads it, enabling code execution when models saved with pickle/joblib are loaded. Google patched the issue in v1.144.0 (randomized bucket names) and v1.148.0 (ownership verification); upgrade to 1.148.0+ and explicitly set staging_bucket, plus audit all google-cloud-aiplatform usage across notebooks, CI jobs, and pipelines. No CVE has been assigned as of publication, and no exploitation in the wild was observed.