“This research highlights how a single malicious model deployment could compromise an entire AI environment.”
One permission to create a custom job in Google’s Vertex AI was enough to reach everything else in the project. A poisoned model deployed to an endpoint gave Unit 42 the images of every other deployed model and the buckets holding them, fine-tuned LLM adapters included. Companies pay to fine-tune on private data, then park the result next to any model a teammate uploads. Google patched these two bugs, not the habit of trusting whatever gets deployed.