Defending AI Infrastructure's New Attack Surface

Gabe Schuyler opens by noting that organizations are adopting AI faster than they can secure it, and that many of the problems he describes are older infrastructure failures rather than flaws unique to models. He points to familiar issues such as open databases and storage buckets, weak authentication on orchestration and notebook environments, and default settings that ship without access controls. Incidents cited include exposed training data, a misconfigured vendor storage bucket, and a biometric database holding the fingerprints and faces of a million people.

Newer exposures include API keys leaked into public code repositories, resource hijacking of exposed notebooks for cryptomining, malicious models found in public model hubs, cross-tenant data leakage, data residency concerns when staff paste proprietary code into hosted services, and prompt-based attacks such as hidden instructions and plugin or agent abuse with excessive permissions. He notes that some risks, like training data poisoning and jailbreaks, appear more overhyped than actually observed.

He closes with practical defenses: strong authentication in front of control planes and notebooks, rate limiting, logging and monitoring of workloads, secret scanning in CI/CD, mirrored and vetted container images, least privilege for agents, posture management tools to inventory exposed assets, and a sanctioned internal AI platform backed by policy and education. The main takeaway is that asset visibility, access control and logging still apply to AI systems.