Attackers Weaponize AI Model Serving Platforms for Cryptomining and Data Exfiltration
A sophisticated threat campaign is exploiting misconfigured machine learning inference endpoints to deploy cryptominers and steal training data, revealing a new attack surface as AI infrastructure becomes increasingly prevalent in enterprise environments.
Security researchers have identified a novel attack campaign targeting machine learning model serving platforms, representing the first large-scale exploitation of AI infrastructure for both cryptocurrency mining and intellectual property theft. The campaign, tracked as Operation Neural Harvest, has compromised over 340 ML inference endpoints across cloud providers since early August.
The attack exploits a fundamental architectural weakness in how many organizations deploy AI models. ML serving platforms typically provision significant GPU resources to handle inference requests, but often lack robust authentication and input validation. Attackers are submitting specially crafted inference requests that trigger code execution on the underlying compute infrastructure.
The exploitation technique is particularly clever. Rather than sending obviously malicious payloads, attackers embed their code within what appears to be legitimate model inputs—for example, hiding shell commands inside image metadata or embedding base64-encoded payloads in text prompts. When the serving platform processes these inputs, vulnerable pre-processing pipelines execute the malicious code before the actual model inference occurs.
Once inside, attackers deploy a two-stage payload. The first stage installs a modified cryptominer optimized for GPU hardware, utilizing the substantial computational resources organizations have provisioned for ML workloads. The second stage targets the model artifacts themselves, exfiltrating training data, model weights, and associated metadata—often representing millions of dollars in research and development investment.
What makes this campaign particularly damaging is its stealth profile. The cryptomining operates at deliberately reduced intensity to avoid triggering resource utilization alarms, while the data exfiltration masquerades as legitimate model telemetry traffic. In several cases, compromised infrastructure remained undetected for weeks, accruing thousands of dollars in unauthorized compute costs.
The attack surface extends beyond cloud-hosted platforms. Organizations running on-premises ML infrastructure face even greater risk, as many lack the sophisticated monitoring capabilities cloud providers offer. Several compromised endpoints were discovered running completely unsecured inference APIs accessible from the public internet with no authentication whatsoever.
Security teams should immediately audit all ML serving endpoints for proper authentication, implement strict input validation on inference APIs, and monitor GPU utilization patterns for anomalies.