Google Cloud Vertex AI Vulnerability Lets Attackers Take Over and Poison AI Models

A critical vulnerability dubbed “Pickle in the Middle” in the Google Cloud Vertex AI Python SDK allowed attackers to predict and pre-create deterministic staging buckets (bucket squatting), then use a malicious Cloud Function and a narrow race condition to replace uploaded model artifacts with pickled payloads. When Vertex AI deserialized these poisoned models (via joblib/pickle), attackers achieved cross-tenant remote code execution and exfiltrated OAuth tokens; Google released fixes (randomized bucket names and ownership checks) in subsequent SDK versions and patched the issue by April 15, 2026.