Official Google announcements or security update logs

Google Fixes Vertex AI Vulnerabilities Leading to Privilege Escalation and Model Leaks

Nov 15, 2024, 05:10 AM

Google has fixed two critical vulnerabilities in its Vertex AI platform that could have led to privilege escalation and exfiltration of fine-tuned machine learning (ML) models and large language models (LLMs). The flaws, identified by researchers from Palo Alto Networks' Unit 42, allowed attackers to manipulate custom job permissions and AI Pipelines, gaining backdoor access to Google Cloud and Kubernetes. The vulnerabilities, which were reported by multiple sources, highlight significant risks in AI and cloud infrastructure security. One of the vulnerabilities is identified as CVE-2024-10979.