Model Namespace Reuse: An AI Supply-Chain Attack Exploiting Major Cloud Platforms

Palo Alto Networks' Unit 42 details an AI supply‑chain attack technique called Model Namespace Reuse that can yield remote code execution and other capabilities on platforms such as Azure AI Foundry, Google Vertex AI, and thousands of open‑source projects.[24] The attack occurs when pipelines retrieve models by name from catalogs and an attacker re‑registers an abandoned or transferred model namespace, allowing deployment of a malicious replacement model into production workflows.[24] The advisory notes that cloud providers have begun mitigation measures, such as Google scanning for orphaned models, and recommends treating model references like other dependencies subject to policy, review, and scanning, which is directly applicable to startups and SaaS teams automating model deployment.[24][19]

Unit 42 reports a supply-chain technique called Model Namespace Reuse in which an attacker can re-register an abandoned or transferred model namespace and replace a model that downstream pipelines fetch by name, potentially leading to remote code execution on platforms including Azure AI Foundry and Google Vertex AI. The report also notes mitigation steps by cloud providers, such as scanning for orphaned models, and recommends treating model references like other software dependencies. RealGround implication: teams that automate model retrieval and deployment should add namespace ownership checks, dependency review, and catalog scanning to prevent malicious model substitution.