Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Mode Leak: Privilege Escalation to LLM Model Exfiltration in Vertex AI

Summary: Palo Alto Networks' Unit 42 researchers found two vulnerabilities in Google's Vertex AI platform, one a privilege escalation through custom job code injection that let them act as the AI Platform Custom Code Service Agent and read and export Cloud Storage and BigQuery data beyond their intended scope. The second let a poisoned model deployed to an endpoint run a reverse shell as the custom-online-prediction service account, move into Kubernetes via IAM Workload Identity Federation, and exfiltrate other ML models and fine-tuned LLM adapters; Google has implemented fixes.

What's compelling: A single permission, aiplatform.customJobs.create, was enough to reach the source project's buckets and datasets, and a model pulled from a public repository was enough to reach every other model in the project, including the fine-tuned adapters that encode your tuning data.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
AI Security
Related