What happened
A predictable Cloud Storage bucket-naming pattern in the Gemini Enterprise Agent Platform Python SDK allows an unauthenticated attacker to pre-claim a bucket a victim tenant will later use, achieving cross-tenant remote code execution and tenant-project token theft — the third publicly disclosed bucket-squatting flaw in this SDK family in 2026.
Why it matters
Google Cloud's Gemini Enterprise Agent Platform is a widely deployed managed AI-agent/ML platform; a cross-tenant RCE plus token-theft primitive in its own SDK threatens any organization building agents, training pipelines, or notebooks on the platform with unpatched SDK versions, and the recurrence of the same architectural bug (GeminiSquat, MountSquat, VertexSquat, and now this) signals a systemic naming-convention weakness rather than an isolated defect.
Attack vector
The SDK relies on predictable, non-tenant-scoped Cloud Storage bucket naming. An attacker can pre-create a bucket at the predictable name before a victim tenant does ('bucket squatting'), causing the victim's SDK workflow to read/write through the attacker-controlled bucket — enabling remote code execution in the victim's environment and theft of tenant-project access tokens.
Affected systems
Google Cloud Gemini Enterprise Agent Platform SDK for Python, versions prior to 1.166.1
Mitigation
Update to google-cloud-aiplatform / Gemini Enterprise Agent Platform SDK for Python 1.166.1 or later. This is the same architectural weakness class as prior disclosed 'GeminiSquat' and 'VertexSquat' bucket-squatting bugs in the same SDK family, so operators should audit all pinned SDK versions across notebooks, CI jobs, and training pipelines, not just production.