{"schema_version":"0.10.0","id":"LR-2026-0587","record_version":1,"title":"Google Vertex AI SDK flaw let attackers hijack model uploads via bucket squatting","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":47.6,"score_breakdown":{"source_authority":12.1,"independent_corroboration":7.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":3.0,"completeness":4.16,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-11-01","extraction_run_id":null,"evidence_level":{"level":"preliminary","reason":"1 report: The Hacker News · subject to change","original_document":null,"reports_total":1,"reports_independent":1,"reports_derivative":0,"developing":false,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-11-01","history":[{"date":"2026-11-01","from_level":null,"to_level":"preliminary","reason":"1 report: The Hacker News · subject to change"}]},"sources_hash":"dab97eb1ab16eed5f7937e21abc7bc9e07484536a43bf10303bcb6bdf7504730"},"system":{"model_name":null,"model_version":null,"developer":"Google","harness":null,"tools_granted":[],"permissions_scope":null,"autonomy_level":"unknown","guardrails_present":[],"deployment_context":"unknown","tier":null,"lifecycle_stage":null,"integration_type":null,"intended_use":null,"safeguard_state":null,"production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2026-06-16","incident_class":"security_compromise","failure_class":null,"agent_involved":null,"secondary_failure_classes":[],"trigger":"unknown","duration":null,"detection_method":"third_party","summary":"The Google Cloud Vertex AI SDK for Python, when a user did not set a staging bucket, generated a predictable Cloud Storage bucket name from the project ID and region and did not verify who owned it. An outside party could create that bucket first, have the SDK upload a model there, and replace it with a malicious one. When Vertex AI loaded the swapped model, the attacker's code ran in the serving container and could take an OAuth token. Palo Alto Networks Unit 42 found the flaw and reported it through Google's bug bounty program. Google shipped an initial fix in v1.144.0 and completed it in v1.148.0, adding bucket ownership verification. Unit 42 said it saw no exploitation in the wild.","tags":[],"date_detected":null,"near_miss":null,"root_cause":null,"root_cause_detail":null,"failure_class_detail":null,"responsible_party":"provider","adversarial_actor":"external_attacker","input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":null,"precursor_events":null,"primary_risk":"RK08","secondary_risks":["RK03"]},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"minor","severity_because":"Test: minor, contained with no third party touched. Fact: Unit 42 said it saw no exploitation in the wild.","harm_class":["none_materialised"],"affected_description":null,"protected_class_involved":null,"data_categories_exposed":[],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://thehackernews.com/2026/06/google-vertex-ai-sdk-flaw-let-attackers.html","publisher":"The Hacker News","date":"2026-06-16","type":"press","title":"Google Vertex AI SDK Flaw Let Attackers Hijack Model Uploads via Bucket Squatting - The Hacker News","archived_url":null,"attachment":"first_report","independence":"independent"}],"per_field_confidence":{"system.developer":"C","event.incident_class":"C","event.detection_method":"C","event.responsible_party":"C","event.adversarial_actor":"C","impact.harm_class":"C","impact.severity":"D","impact.severity_because":"D","event.primary_risk":"D","event.secondary_risks":"D","event.summary":"C","system.autonomy_level":"D","system.deployment_context":"D","event.trigger":"D","context.country":"D","event.date_disclosed":"D","context.denominator_available":"D"},"field_citations":{"system.developer":[{"source_index":0,"quote":"A flaw in the Google Cloud Vertex AI SDK for Python let an attacker with no access to a victim's project hijack the victim's machine learning model upload and run code inside Google's serving infrastructure."}],"event.incident_class":[{"source_index":0,"quote":"A flaw in the Google Cloud Vertex AI SDK for Python let an attacker with no access to a victim's project hijack the victim's machine learning model upload and run code inside Google's serving infrastructure."}],"event.detection_method":[{"source_index":0,"quote":"Palo Alto Networks Unit 42, which found and reported the bug through Google's bug bounty program, calls the technique \"Pickle in the Middle\" and said it saw no exploitation in the wild."}],"event.responsible_party":[{"source_index":0,"quote":"A flaw in the Google Cloud Vertex AI SDK for Python let an attacker with no access to a victim's project hijack the victim's machine learning model upload and run code inside Google's serving infrastructure."}],"event.adversarial_actor":[{"source_index":0,"quote":"The attacker needed only a Google Cloud project of their own and the victim's project ID, which is often public."}],"impact.harm_class":[{"source_index":0,"quote":"Palo Alto Networks Unit 42, which found and reported the bug through Google's bug bounty program, calls the technique \"Pickle in the Middle\" and said it saw no exploitation in the wild."}],"impact.severity":[{"source_index":0,"quote":"Palo Alto Networks Unit 42, which found and reported the bug through Google's bug bounty program, calls the technique \"Pickle in the Middle\" and said it saw no exploitation in the wild."}],"impact.severity_because":[{"source_index":0,"quote":"Palo Alto Networks Unit 42, which found and reported the bug through Google's bug bounty program, calls the technique \"Pickle in the Middle\" and said it saw no exploitation in the wild."}],"event.summary":[{"source_index":0,"quote":"The flaw was in how the SDK chose a temporary Cloud Storage bucket for model uploads."},{"source_index":0,"quote":"It checked whether that bucket existed, but not whether the victim owned it."},{"source_index":0,"quote":"The payload then stole an OAuth token from the serving container's metadata server and sent it to the attacker."},{"source_index":0,"quote":"Palo Alto Networks Unit 42, which found and reported the bug through Google's bug bounty program, calls the technique \"Pickle in the Middle\" and said it saw no exploitation in the wild."},{"source_index":0,"quote":"It completed the fix in v1.148.0 on April 15, adding bucket ownership verification to block bucket squatting in Model.upload()."}]},"notes_on_gaps":"No autonomous agent is described; the incident is a software flaw in an SDK, so agent fields and failure classes are omitted. No exploitation in the wild is reported. No loss, record count, affected-party count, country, industry, model name or deployment context is stated, so those are omitted. Disclosure date is not stated (the article date 2026-06-16 is publication, not disclosure), so date_disclosed is omitted. The detection date is taken as the date Unit 42 reported the flaw. Severity minor is my judgement: no third party was touched and no exploitation occurred. The controls and risk choices are my judgement from the fix described; the source names no control id. The tested-versions event is undated in the source. The Vertex AI Experiments CVE-2026-2473 mentioned in the source is a separate incident and is not reported. Root cause integration is my judgement that the SDK's client-side bucket selection is an integration defect. [case created by the backfill: read by claude-haiku-5-5, backfill-2026-11-01.2, 2026-11-01; not yet reviewed] [2026-11-01: evidence level set: Preliminary (1 report: The Hacker News · subject to change)]"},"context":{"industry":null,"org_size_band":null,"country":"unknown","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"doing","text":"The Vertex AI SDK for Python chose a temporary Cloud Storage bucket for model uploads.","quote":"The flaw was in how the SDK chose a temporary Cloud Storage bucket for model uploads.","source_index":0,"grade":"C"}],"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://thehackernews.com/2026/06/google-vertex-ai-sdk-flaw-let-attackers.html"]},"analysis":{"sections":{"timeline":[{"text":"Unit 42 tested versions 1.139.0 and 1.140.0 and found both vulnerable.","quote":"It tested versions 1.139.0 and 1.140.0, the latest available at the time, and found both vulnerable.","source_index":0,"when":null},{"text":"Unit 42 reported the flaw to Google through its Vulnerability Reward Program.","quote":"Unit 42 reported the flaw through Google's Vulnerability Reward Program on March 5, 2026.","source_index":0,"when":"2026-03-05"},{"text":"Google shipped an initial fix in v1.144.0, adding a random uuid4 to the bucket name.","quote":"Google shipped an initial fix in v1.144.0 on March 31, adding a random uuid4 to the bucket name.","source_index":0,"when":"2026-03-31"},{"text":"Google completed the fix in v1.148.0, adding bucket ownership verification.","quote":"It completed the fix in v1.148.0 on April 15, adding bucket ownership verification to block bucket squatting in Model.upload().","source_index":0,"when":"2026-04-15"}]},"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://thehackernews.com/2026/06/google-vertex-ai-sdk-flaw-let-attackers.html"]}}