[NEWSLETTER]score: 0.86

Vertex AI Python SDK Bucket Squatting Bug Enabled Model Hijacking

June 17, 2026

A predictable staging bucket naming pattern in Google Cloud Vertex AI Python SDK allowed attackers to pre-register buckets and replace legitimate model uploads with malicious code. The fix shipped in SDK versions v1.144.0 and v1.148.0 — teams should upgrade immediately.

HOW THIS AFFECTS YOU

●

builderUpgrade the Vertex AI Python SDK to v1.144.0 or v1.148.0 immediately if you use model upload workflows in Google Cloud.

●

policyModel supply chain integrity is a concrete attack surface — this is a documented exploit pattern worth including in AI deployment security reviews.

read original ↗thehackernews.com

← back to feed