BREAKING
Vertex AI SDK Flaw Enabled Model Swap
How the Bucket Squatting Worked
1
No staging_bucket set
↓
2
Predictable bucket name
↓
3
Attacker pre-creates it
↓
4
Artifact lands in attacker bucket
0
s
Attack window
0
s
PoC swap time
Malicious Model, Remote Code Execution
Reported, Then Fixed by Google
Partial fix
v1.144.0
●
March 31, 2026
●
UUID added to bucket name
Complete fix
v1.148.0
●
April 15, 2026
●
Ownership verification added
Set staging_bucket, Don't Trust Defaults
AI NEWS BLITZ
Unit 42 found a Vertex AI SDK flaw that let attackers swap models in seconds.