Exposed AI infrastructure: internet-facing AI servers hijacked for mining and scanning

What happened

Two research reports describe attackers taking over exposed AI infrastructure, meaning AI servers and tools that can be reached from the internet.

On November 18, 2025, Oligo Security reported an active campaign it calls ShadowRay 2.0. It exploits CVE-2023-48022 in Ray, an open-source framework for running AI workloads, which Oligo says allows unauthenticated remote code execution through Ray’s Jobs API. Oligo notes the flaw is “disputed” because Ray’s maintainers say Ray isn’t intended for use outside a “strictly-controlled network environment,” and it says there is no specific version to upgrade to. Oligo reports that attackers turned exposed clusters into a self-spreading cryptomining botnet, and says its analysis shows they “leveraged LLM-generated payloads.” It says the attackers capped CPU use at about 60% to avoid detection, and that “evidence suggests” the operation could have been active since September 2024. The report gives figures of both “more than 230,000” and “over 200,000” Ray servers exposed to the internet. Oligo says the campaign is unrelated to the paid products of Anyscale, the company that develops Ray.

On October 7, 2026, Lumen’s Black Lotus Labs described PoeLLM, malware it has tracked since April 2026. Lumen says most victims “appear to be running vulnerable versions of open-source AI/LLM services, such as LiteLLM and Ollama.” It says the malware installs cryptocurrency miners and turns infected servers into scanners and exploit servers to find more victims. Lumen says the malware has impacted “more than 3,400 victim servers,” with peak activity “exceeding 800 active servers per day.” Elsewhere it says the campaign involved “almost 2,200 affected servers” at its mid-June peak, “with nearly 800 active per day.”

Why it matters to leaders (our analysis)

Lumen notes that as AI infrastructure grows, “new tools often go unmonitored for vulnerabilities despite access to powerful compute and valuable enterprise data.” Both reports point to the same result: servers with valuable compute and data, reachable from the internet, that attackers can find and use automatically. In Ray’s case, the maintainers’ position is that security has to be enforced around the cluster, so exposure is a deployment decision rather than something a patch fixes.

The response is ordinary attack-surface management applied to a newer class of system: know what you expose, put authentication and network controls in front of it, and watch for compute you didn’t schedule.