A vulnerability in the Vertex AI Python SDK let an unprivileged attacker intercept machine learning model uploads and execute code inside Google’s serving infrastructure.
Summary
- A flaw in the Google Cloud Vertex AI SDK for Python enabled a technique researchers call ‘Pickle in the Middle’, allowing an attacker with no access to a victim’s project to hijack ML model uploads.
- The attack path led to code execution inside Google’s own model-serving infrastructure, not just within the victim’s environment.
- The vulnerability was discovered and responsibly disclosed by Palo Alto Networks Unit 42 through Google’s bug bounty programme.
- Google has since addressed the flaw; no exploitation in the wild was observed.
What was found
Researchers at Palo Alto Networks Unit 42 identified a vulnerability in the Google Cloud Vertex AI SDK for Python that allowed an attacker who had no legitimate access to a target’s Google Cloud project to intercept machine learning model uploads. The technique, which Unit 42 named ‘Pickle in the Middle’, exploited a weakness related to bucket squatting — the ability to pre-register or predict the name of a Cloud Storage bucket that the victim’s SDK would use during a model upload operation.
How the attack worked
The core of the issue lies in how the Vertex AI SDK handles intermediate storage during the model upload process. By squatting on a bucket name the SDK was expected to use, an attacker could position a malicious payload — in this case, a weaponised Pickle file — in the path of the upload. Because Python’s Pickle format can embed arbitrary executable code, a file crafted this way could run code when deserialised. Critically, that execution did not stay within the victim’s environment; it reached into Google’s own model-serving infrastructure, significantly raising the blast radius of a successful attack.
Scope and current status
Unit 42 reported the vulnerability to Google through its bug bounty programme. Google has addressed the flaw. The researchers stated they observed no evidence of exploitation in the wild at the time of disclosure. The sources available do not specify the exact remediation steps Google applied to the SDK, nor the timeline between discovery and patch.
The broader supply chain concern
This finding sits within a wider pattern of risk in machine learning pipelines. The Pickle format has long been flagged by the security community as unsafe for loading untrusted model files, yet it remains widely used across ML frameworks. Combining that known serialisation risk with a predictable or squattable cloud storage path creates an attack chain that does not require any privileged access to a victim’s environment — only the ability to observe or predict naming conventions and act before the legitimate upload occurs.
What remains unknown
The source material does not detail which specific versions of the Vertex AI Python SDK were affected, the precise mechanism by which bucket names could be predicted or squatted, or the full scope of Google’s fix. Organisations relying on corroborating advisories from Google or the SDK’s changelog should consult those sources directly for version-specific guidance.
Why it matters
For security executives overseeing cloud and AI/ML workloads, this vulnerability highlights that the attack surface of a machine learning pipeline extends well beyond the model itself. An adversary operating entirely outside your Google Cloud project boundary could, under the right conditions, inject malicious code that executes inside a cloud provider’s serving infrastructure — a scenario that sits outside most traditional threat models. The use of Pickle as the delivery mechanism is a reminder that insecure deserialisation risks do not disappear simply because a model lives in a managed cloud service. As organisations accelerate AI adoption on platforms like Vertex AI, the security of the surrounding SDK tooling, storage naming conventions, and serialisation formats deserves the same scrutiny applied to application code.
What to do now
- Verify that your Vertex AI Python SDK installations are updated to the version that addresses this vulnerability, and consult Google’s official release notes or security advisories for confirmation.
- Review your ML pipeline architecture to understand which Cloud Storage buckets are used during model upload operations and assess whether those bucket names could be predicted or squatted by an external party.
- Evaluate whether your organisation’s use of Pickle-serialised model files can be reduced or replaced with safer serialisation formats, particularly for models ingested from external or less-trusted sources.
- Include ML pipeline components — SDKs, storage configurations, and serialisation formats — in your cloud security posture reviews and threat modelling exercises.
