ShadowRay: Exploiting Exposed Ray AI Compute Clusters
Ray's Job API allows remote execution by design and ships without authentication. Thousands of internet-exposed clusters let attackers run code, steal cloud credentials and AI artifacts, and hijack GPUs for cryptomining.
What happened
Catalogued by MITRE ATLAS as AML.CS0023, ShadowRay exploited Ray, a popular open-source framework for scaling AI workloads. Ray’s Job API allows arbitrary remote execution by design and ships without authentication, and the default configuration can expose the dashboard to the network. Attackers scanned for the thousands of internet-exposed clusters and used them to run code, read cloud credentials and collect AI artifacts (models, datasets, tokens), and hijack expensive GPUs for cryptomining.
There was no memory-corruption exploit involved — the “vulnerability” was an exposed, unauthenticated remote-execution surface on high-value AI compute. It’s a stark reminder that AI infrastructure inherits ordinary infra security requirements.
Why it maps to ATLAS
- AML.T0006 — Active Scanning: attackers scan the internet for exposed Ray dashboards.
- AML.T0049 — Exploit Public-Facing Application: the unauthenticated Job API is abused for execution.
- AML.T0035 — AI Artifact Collection: models, datasets, and tokens are collected from the cluster.
- AML.T0055 — Unsecured Credentials: cloud credentials on the nodes are harvested.
- AML.T0048.000 — External Harms: Financial Harm: hijacked GPUs are used for cryptomining.
Detection notes
Don’t expose Ray (or any compute framework with remote-exec) to the internet — enforce authentication and network isolation, and give nodes least-privilege cloud roles. Alert on exposed dashboards, unauthorized job submissions, cloud-credential reads, and sustained GPU utilization consistent with mining.
Detection
Log sources
- Ray dashboard/Job API exposure + access logs
- Cloud credential access + GPU utilization telemetry
- Egress from cluster nodes
Signals
- Internet-exposed Ray dashboards / Job API with no auth
- Unexpected jobs submitted to the cluster
- Cloud-credential reads and sustained GPU use consistent with mining
Mitigations
- Never expose Ray to the internet; enforce auth + network isolation
- Least-privilege cloud roles on cluster nodes; rotate exposed credentials
- Monitor for unauthorized jobs and anomalous GPU/egress usage