google-cloud-aiplatform 1.139.0-1.140.0 uses predictable default GCS staging bucket names and checks only bucket existence, enabling cross-project bucket squatting and model artifact hijack when no staging bucket is set. Attackers can swap uploaded model files and trigger pickle-based code execution during model load in Vertex AI serving. Upgrade to 1.148.0+ and set an explicit staging bucket.