Use case sources
Source reports and analysis supporting this case are listed below. AITBM interpretation and any indicative scoring are derived from this public evidence.
Incident overview
Google Colab is a Jupyter Notebook service that executes on virtual machines. Jupyter Notebooks are often used for ML and data science research and experimentation, containing executable snippets of Python code and common Unix command-line functionality. In addition to data manipulation and visualization, this code execution functionality can allow users to download arbitrary files from the internet, manipulate files on the virtual machine, and so on.
Users can also share Jupyter Notebooks with other users via links. In the case of notebooks with malicious code, users may unknowingly execute the offending code, which may be obfuscated or hidden in a downloaded script, for example.
When a user opens a shared Jupyter Notebook in Colab, they are asked whether they'd like to allow the notebook to access their Google Drive. While there can be legitimate reasons for allowing Google Drive access, such as to allow a user to substitute their own files, there can also be malicious effects such as data exfiltration or opening a server to the victim's Google Drive.
This exercise raises awareness of the effects of arbitrary code execution and Colab's Google Drive integration. Practice secure evaluations of shared Colab notebook links and examine code prior to execution.
Why this record has no ERS
The researcher used a Jukebox notebook as motivation and demonstrated malicious shared-notebook code paths separately. The source does not show that an identifiable AI workload was affected by those demonstrations.
Status: Not scorable by design · Classification: Exercise · source date 2026-08-02 · primary evidence date 2022-07-01
SecureFlow attack flow
This record mirrors an AIDEFEND SecureFlow flow (MITRE ATLAS case-study conversion): an ordered attack path with MITRE ATLAS tactic and technique labels and the AIDEFEND controls matched to each step. The flow documents what happened and which controls apply; it does not establish an assessed deployment.
| MITRE ATLAS case study | AML.CS0018 (exercise) |
|---|---|
| Target | Google Colab |
| Actor | Tony Piazza |
| Primary evidence date | 2022-07-01 |
| SecureFlow record updated | 2026-08-02 |
| AI layers | Tool integrations / MCP, AI supply chain |
| Risk impact | System compromise / RCE, Data exfiltration |
| Affected components | Google Colab notebook runtime, shared Jupyter notebook, mounted Google Drive storage, ML model artifacts and proprietary data |
Attack steps
| # | Step | ATLAS tactic / technique |
|---|---|---|
| 1 | Author Obfuscated Malicious Colab NotebookAn adversary creates a Jupyter notebook containing obfuscated, malicious code. | AML.TA0003 AML.T0017 |
| 2 | Distribute Compromised Notebook to VictimsJupyter notebooks are often used for ML and data science research and experimentation, containing executable snippets of Python code and common Unix command-line functionality. Users may come across a compromised notebook on public websites or through direct sharing. | AML.TA0004 AML.T0010.001 |
| 3 | Induce Victim to Mount Google DriveA victim user may mount their Google Drive into the compromised Colab notebook. Typical reasons to connect machine learning notebooks to Google Drive include the ability to train on data stored there or to save model output files. ``` from google.colab import drive drive.mount(''/content/drive'') ``` Upon execution, a popup appears to confirm access and warn about potential data access: > This notebook is requesting access to your Google Drive files. Granting access to Google Drive will permit code executed in the notebook to modify files in your Google Drive. Make sure to review notebook code prior to allowing this access. A victim user may nonetheless accept the popup and allow the compromised Colab notebook access to the victim''s Drive. Permissions granted include: - Create, edit, and delete access for all Google Drive files - View Google Photos data - View Google contacts | AML.TA0004 AML.T0012 |
| 4 | Execute Malicious Notebook CodeA victim user may unwittingly execute malicious code provided as part of a compromised Colab notebook. Malicious code can be obfuscated or hidden in other files that the notebook downloads. | AML.TA0005 AML.T0011 |
| 5 | Search System for Private Data and ML ArtifactsAdversary may search the victim system to find private and proprietary data, including ML model artifacts. Jupyter Notebooks allow execution of shell commands (https://colab.research.google.com/github/jakevdp/PythonDataScienceHandbook/blob/master/notebooks/01.05-IPython-And-Shell-Commands.ipynb). This example searches the mounted Drive for PyTorch model checkpoint files: ``` !find /content/drive/MyDrive/ -type f -name *.pt ``` > /content/drive/MyDrive/models/checkpoint.pt | AML.TA0009 AML.T0035 |
| 6 | Open Tunnel Server to Exfiltrate Drive FilesAs a result of Google Drive access, the adversary may open a server to exfiltrate private data or ML model artifacts. An example from the referenced article shows the download, installation, and usage of `ngrok`, a server application, to open an adversary-accessible URL to the victim's Google Drive and all its files. | AML.TA0010 AML.T0025 |
| 7 | Steal ML Model ArtifactsExfiltrated data may include sensitive or private data such as ML model artifacts stored in Google Drive. | AML.TA0011 AML.T0048.004 |
| 8 | Harm Victim via Stolen Proprietary DataExfiltrated data may include sensitive or private data such as proprietary data stored in Google Drive, as well as user contacts and photos. As a result, the user may be harmed financially, reputationally, and more. | AML.TA0011 AML.T0048 |
Threat references
Summary and attack steps reproduced from AIDEFEND SecureFlow (https://aidefendlabs.com/en/secureflow/?flow=atlas-aml-cs0018-google-colab-arbitrary-code-execution; AIDEFEND content CC BY 4.0), converted from MITRE ATLAS case study AML.CS0018 (Apache License 2.0; MITRE ATLAS is a trademark of The MITRE Corporation).
AIDEFEND evidence routes
AIDEFEND defences → AITBM sub-metrics
Identifiers are quoted as they appear on the AIDEFEND in Action brief or in the AIDEFEND SecureFlow defense map (audited AIDEFEND dataVersion 2026.10.15); the sub-metric mapping is AITBM's own, from the specification's AIDEFEND tables reconciled at catalogue data version 2026.10.15. AIDEFEND renumbers identifiers between releases, so the data version travels with every mapping and neither side's IDs should be cited without one. A mapping identifies a possible evidence route; a recommendation does not prove that the control was implemented or effective and receives no scoring credit by itself.
| Technique | Defence | Priority | Evidences |
|---|---|---|---|
| AID-I-001.004 | Sandbox Network Egress RestrictionsExact SecureFlow defense-map identifier (flow atlas-aml-cs0018-google-colab-arbitrary-code-execution), verified against AIDEFEND dataVersion 2026.10.15; matched to attack steps step-4, step-6, step-7. Presence supplies no score credit. | Candidate evidence route | Pr-2 Cn-7 |
| AID-H-013.003 | Black-Box Behavioral Ownership FingerprintingExact SecureFlow defense-map identifier (flow atlas-aml-cs0018-google-colab-arbitrary-code-execution), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-7. Presence supplies no score credit. | Candidate evidence route | Ro-4 Pr-1 |