Model Namespace Reuse Allows Remote Code Execution on Azure AI and Vertex AI
Researchers discovered a Model Namespace Reuse vulnerability allowing attackers to achieve remote code execution on AI platforms including Microsoft Azure AI Foundry and Google Vertex AI by re-registering abandoned model namespaces on Hugging Face. The flaw affects any organization that retrieves AI models by name alone without additional verification.
What happened
Unit 42 researchers at Palo Alto Networks discovered a flaw they termed Model Namespace Reuse that allows attackers to gain Remote Code Execution (RCE) on major platforms including Microsoft Azure AI Foundry, Google Vertex AI and thousands of open-source projects.
The attack exploits how Hugging Face organizes models by namespace identifiers. When a model namespace is deleted or transferred, attackers can re-register the abandoned namespace and recreate its original path, allowing malicious actors to target pipelines that deploy models based solely on their name.
Reported impact
By deploying malicious models through re-registered namespaces, attackers can gain code execution capabilities and potentially access to systems that pull models by name alone.
The vulnerability affects any organization that retrieves models from Hugging Face by name without additional verification mechanisms.
Index analysis
The researchers established that trusting models based solely on their names is insufficient and that this represents a fundamental flaw in the AI supply chain.
The issue demonstrates that cloud provider model catalogs and code repositories that rely on model names for retrieval are vulnerable to namespace reuse attacks.
Governance controls
Palo Alto Networks Unit 42 reported responsible disclosure to Google, Microsoft and Hugging Face; however, the core issue remained a threat to organizations pulling models by name alone.
Organizations can assess their security posture through Unit 42's Cloud Security Assessment and AI Security Assessment offerings.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.