ShadowRay: First Known Attack Campaign Targeting AI Workloads Actively Exploited In The Wild

The talk introduces "shadow vulnerabilities," flaws in open-source libraries that are disputed or documented only as intended behavior, so they never receive a CVE that scanners can flag. The speaker argues that these issues matter especially for AI, where fast adoption, expensive GPU compute, and sensitive data make the underlying infrastructure an attractive target.

The central case study is Ray, a distributed framework used to run AI workloads. A disputed issue meant its jobs dashboard and REST API listened on all interfaces by default and accepted job submissions without authentication. Internet-wide scanning turned up thousands of exposed servers, some of which had been reachable for close to a year. Because submitted jobs were echoed in the console, the team could follow attacker activity, which included reverse shells, crypto miners, and rival miners competing to shut each other down. Exposed hosts also leaked credentials such as SSH keys, cloud keys, and API tokens. The researchers reproduced the same techniques to show how far a compromised cluster could reach.

The discussion covered how hard it is to get developers and businesses to act on documentation-only risks, and why relying on maintainers to add controls is not enough. The speaker described runtime approaches, such as profiling libraries against their expected behavior and flagging unsafe configurations, to catch problems that have no published CVE. The practical takeaway is to treat default settings of AI tooling as untrusted, check what is reachable from the network, and watch for libraries that unexpectedly spawn processes or open connections.