Google Cloud Vertex AI Allows Attacker to Hijack Victim’s Model and Poison it

Unit42 disclosed a vulnerability in the Google Cloud Vertex AI Python SDK that allowed attackers to predict and pre-create staging GCS bucket names (bucket squatting) and, because ownership was not verified, intercept model uploads. Attackers could replace model artifacts milliseconds before deployment and achieve remote code execution through Python pickle deserialization, exposing service account tokens and broad cloud-platform access; the issue affected versions 1.139.0 and 1.140.0 and was fully fixed in 1.148.0.