The rate at which the modern datacenter and AI infrastructure is being built is heavily outpacing the ability to secure it. When this infrastructure, GPU clusters, training pipelines, high-performance networking, and inference endpoints, is compromised, the blast radius is unlike conventional compute. Attackers gain access to proprietary models representing hundreds of millions of dollars, the power to poison foundational training data, and persistent footholds in the most highly privileged environments available.

This dynamic is reinforced by a structural market imbalance: GPU scarcity gives providers outsized leverage. When demand for accelerated compute far outstrips supply, customers often cannot choose their provider based on security posture - they take what is available. Providers face little market pressure to invest in security maturity, and customers accept risk they would not tolerate in conventional cloud. This imbalance is the backdrop against which every risk in this document should be read. This market pressure is becoming more dangerous as AI-enabled security research and exploitation capabilities compress the timeline for defenders. Weaknesses that might once have remained obscure for years may now be discovered, chained, and operationalized much faster.

At the same time, AI-enabled security research and exploitation capabilities are compressing the timeline for defenders: weaknesses that might once have remained obscure for years may now be discovered, chained, and operationalized much faster.

Why AI Infrastructure Security Is Different

AI infrastructure sits at the intersection of cloud computing, high-performance computing, and physical datacenter operations. It uses familiar components such as servers, storage, networks, schedulers, management planes, and identity systems, but combines them in ways that change the security model.

Traditional HPC environments were often designed for trusted users, research communities, or internal operators. Modern AI infrastructure increasingly supports commercial, high-value, multi-tenant workloads from unrelated customers. As a result, assumptions that were acceptable in trusted or single-organization environments can become serious security risks when applied to shared AI infrastructure.

Recent Reporting

Attackers have already begun targeting the infrastructure, supply chains, and datacenter ecosystems that support advanced AI and HPC workloads. In some cases, the objective is direct theft of sensitive research, models, or engineering data, in others, it is espionage, prepositioning, or the ability to disrupt strategically important compute environments. Recent reporting illustrates both patterns:

These are early examples. The attack surface is likely to expand as the stack matures, and this document will evolve alongside it.

Threat Model

The risk is best understood by looking at potential attackers. The threat model spans far more than the classic "outside attacker", and the controls in this document are calibrated against the full set.

External attacker

An unauthenticated or unauthorized actor with network access.

Compromised cloud customer

A legitimate customer account, tenant, or workload that has been compromised and is operating on the provider’s shared infrastructure.

Malicious enterprise insider

An employee or contractor of the AI-consuming organization with legitimate access.

Malicious or compromised insider

An employee, contractor, technician, system integrator, logistics provider, or break-fix vendor with legitimate access to the customer or provider environment.

In-transit adversary

An actor with access to hardware or components during manufacturing, staging, warehousing, shipping, or delivery before they reach the provider’s secured environment.

System integrator

An organization responsible for assembling, configuring, or shipping complete systems from individual components.

Supplier

An upstream hardware, firmware or driver vendor.

AI agents

Any AI agents acting on behalf of and impersonating any of the above.