A model upload path that looks SDK-managed can be taken over from another Google Cloud project. If the staging bucket name is predictable and ownership is never checked, the artifact you think you uploaded can be replaced before deployment.
Unit 42 says the Vertex AI Python SDK created that opening when users left the staging bucket unset. The SDK built a default bucket name from project and region details, an attacker could claim that name first in their own project, and the affected upload would land in attacker-controlled storage before the model was swapped; Google fixed the issue in google-cloud-aiplatform v1.148.0.
The break is bigger than one library bug. Any workflow that auto-creates cloud resources from deterministic names can hand control to a different project without a direct compromise of the target account.