'Pickle in the Middle': Vertex AI SDK Bug Let Outsiders Hijack Model Uploads

A flaw in the Google Cloud Vertex AI SDK for Python let an unauthenticated outsider intercept a victim's machine learning model upload and run attacker-controlled code inside Google's serving infrastructure, according to research from Palo Alto Networks Unit 42.

The team is calling the technique Pickle in the Middle. Google patched the SDK after a bug bounty report. Unit 42 says it has not observed exploitation in the wild.

The mechanics are quiet but ugly. The Vertex AI SDK, under certain workflows, staged model artifacts through a Cloud Storage bucket whose name an attacker could predict or claim first. Classic bucket squatting. Once the adversary owned the bucket the victim's tooling expected to write to, the victim's pickled model file landed in attacker-controlled storage on the way to deployment.

Pickle does the rest. Python's pickle format executes code on deserialization, so a tampered artifact loaded by Vertex AI's prediction container runs whatever the attacker baked in — inside Google's managed serving environment, under the victim's service identity.

That is the part worth sitting with. The compromise does not require any IAM foothold in the target project. It only requires that the victim use the vulnerable SDK path and that the attacker get to the bucket name first.

Unit 42's writeup frames this as a supply-chain-adjacent issue rather than a Vertex AI platform vulnerability per se, and the distinction matters for anyone doing detection engineering. The trust boundary that broke was between the developer's machine and the cloud storage layer, not the model server itself. The model server behaved exactly as designed. It loaded a pickle.

There is no public CTI cluster tied to this technique yet, and no vendor has attributed activity to a named actor. Treat capability and intent separately here. The capability is real and well documented. The intent — who would burn it, against whom — is unproven.

Still, the pattern fits a known interest area. ML pipeline tampering has been on the radar of several China-nexus groups tracked under names like TA413 and the broader Mustang Panda cluster (CrowdStrike's naming), and pickle-based payload delivery has shown up in commodity Python supply-chain attacks for years. Hijacking a Vertex AI upload would give an operator code execution adjacent to production inference, training data access, and potentially the keys to downstream model endpoints.

Mitigations for defenders:

• Upgrade the google-cloud-aiplatform Python SDK to the current release and audit any CI/CD jobs pinned to older versions.
• Pre-create and lock down staging buckets with explicit names rather than letting tooling auto-generate them.
• Treat any pickle artifact crossing a trust boundary as executable code, and prefer safer serialization formats where Vertex AI supports them.
• Log and alert on unexpected writers to model-staging buckets.

The CVE assignment, if one issues, will be worth watching for the exact affected version range.