Executive Summary
Unit 42 details Model Namespace Reuse: when pipelines fetch models by name, an attacker who re-registers an abandoned namespace can serve a malicious model, enabling RCE on platforms like Azure AI Foundry, Vertex AI and many open-source projects.
What Happened
Palo Alto Networks' Unit 42 details an AI supply‑chain attack technique called Model Namespace Reuse that can yield remote code execution and other capabilities on platforms such as Azure AI Foundry, Google Vertex AI, and thousands of open‑source projects.[24] The attack occurs when pipelines retrieve models by name from catalogs and an attacker re‑registers an abandoned or transferred model namespace, allowing deployment of a malicious replacement model into production workflows.[24] The advisory notes that cloud providers have begun mitigation measures, such as Google scanning for orphaned models, and recommends treating model references like other dependencies subject to policy, review, and scanning, which is directly applicable to startups and SaaS teams automating model deployment.[24][19]
Affected Products
- Azure AI Foundry
- Google Vertex AI
- Hugging Face
Vulnerability / Attack Technique
Model namespace hijacking
Technical Mechanism
As reported, name-based model references resolve to an attacker-controlled replacement.
AI Security Category
LLM03:2025 Supply Chain
Part of the AI Supply Chain and AI SBOM topic.
Relevant Frameworks
RealGround Analysis
Model names are not stable identities. RealGround analysis: pin models by revision hash.
Recommended Controls
- Pin models to specific commit hashes
- Mirror approved models internally
Related RealGround Service
AI Agent SBOM and LLM Mapping · or start with the free AI Agent Security Scanner.
Sources
Unit 42 (Palo Alto Networks): https://unit42.paloaltonetworks.com/model-namespace-reuse/
Summary and analysis written by RealGround from the source above; last updated 2026-10-18.