Executive Summary
Unit 42's 'Pickle in the Middle': a Vertex AI Python SDK flaw let attackers hijack a victim's model upload via bucket squatting and run code in Google's serving infrastructure.
What Happened
A flaw in the Google Cloud Vertex AI SDK for Python let an attacker with no access to a victim's project hijack the victim's machine learning model upload and run code inside Google's serving infrastructure. Palo Alto Networks Unit 42, which found and reported the bug through Google's bug bounty program, calls the technique "Pickle in the Middle" and said it saw no exploitation in the wild.
Affected Products
- Google Vertex AI SDK
Vulnerability / Attack Technique
Model upload hijacking via bucket squatting
Technical Mechanism
As reported, a predictable storage bucket could be claimed and serve a malicious model file.
AI Security Category
LLM03:2025 Supply Chain
Part of the AI Supply Chain and AI SBOM topic.
Relevant Frameworks
RealGround Analysis
Predictable bucket names are a model supply chain risk. RealGround analysis: use your own named buckets and safe model formats.
Recommended Controls
- Update the Vertex AI SDK
- Specify owned staging buckets
Related RealGround Service
AI Agent SBOM and LLM Mapping · or start with the free AI Agent Security Scanner.
Sources
thehackernews.com: https://thehackernews.com/2026/06/google-vertex-ai-sdk-flaw-let-attackers.html
Summary and analysis written by RealGround from the source above; last updated 2026-10-18.