The core promise of self-hosted AI is control—keeping models, data, and prompts on infrastructure you manage. But a new study reveals that many organizations are sabotaging that advantage by leaving critical AI infrastructure exposed on the open internet. Researchers identified 36,769 such endpoints, with a staggering 98% lacking basic HTTP authentication.
As highlighted by Security Affairs, the vulnerability lies in the operational supply chain: the supporting components that enable AI models to run, such as model registries, inference servers, and container orchestration panels. When these are left openly accessible, the security rationale for on-premises deployment collapses.
This represents a systemic failure to secure the deployment layer. Researchers point to three primary drivers: insecure default configurations in popular open-source tools, a persistent gap between data scientists and IT security teams, and intense pressure to deploy quickly, often at the expense of thorough security hardening.
The risks extend far beyond intellectual property theft. Attackers could poison models with malicious data, launch denial-of-service attacks to cripple services, or use a compromised AI server as a pivot point to infiltrate wider corporate networks.
These findings overturn the narrow focus on data privacy and model safety as the sole AI security concerns. They underscore that securing foundational infrastructure is now a mandatory baseline. For Hong Kong IT teams, this is a critical reminder: the assumption that "internal" means "secure" is dangerously flawed when assets are internet-facing without controls.
A Five-Step AI Supply Chain Audit Checklist
Treat AI endpoints with the same scrutiny as any critical internet-facing service. Begin with these steps:
- Inventory and Discovery: Identify all AI-related services, including inference endpoints, model repositories (e.g., using MLflow, Seldon, or Hugging Face), and management interfaces for Kubernetes or container clusters.
- Access Review: For every discovered endpoint, immediately verify that authentication is enabled and enforced.
- Network Assessment: Ensure services are not exposed to the public internet unnecessarily. They should reside in secure internal segments, accessible only via VPN or private connections.
- Configuration Hardening: Review default settings for all AI frameworks. Disable insecure features and enforce strong, unique credentials for administrative panels.
- Continuous Monitoring: Implement logging and alerting to detect unauthorized access or anomalous activity across your AI infrastructure.
The drive to deploy AI is understandable, but rushing without securing the supply chain merely shifts risk. The data shows that for many organizations, the self-hosted advantage is currently an illusion, leaving valuable assets and systems vulnerable.
自託管人工智能的核心承諾在於掌控權——將模型、數據和提示詞維護在自行管理的基礎設施上。但一項最新研究揭露，許多機構正因關鍵人工智能基礎設施暴露於開放互聯網而自我削弱此優勢。研究人員識別出36,769個此類端點，其中高達98%缺乏基本HTTP認證機制。
正如《安全事務》所強調，漏洞源於運營供應鏈環節：那些支撐人工智能模型運行的組件，例如模型儲存庫、推理伺服器及容器編排面板。當這些組件被設為公開訪問時，本地部署的安全邏輯便徹底瓦解。
這代表部署層級防護的系統性失敗。研究人員指出三大主因：流行開源工具的預設配置不安全、數據科學家與IT安全團隊之間持續存在的隔閡，以及快速部署的迫切壓力——往往以犧牲徹底的安全加固為代價。
風險遠不止於知識產權盜竊。攻擊者可能以惡意數據投毒模型、發動拒絕服務攻擊癱瘓服務，或利用被入侵的人工智能伺服器作為跳板滲透更廣泛的企業網絡。
這些發現顛覆了過往將數據私隱及模型安全視為人工智能唯一安全隱憂的狭隘視角。它們凸顯保障基礎設施安全現已成為必要基線。對香港IT團隊而言，這是一個關鍵警示：當資產面向互聯網而缺乏管控時，「內部等於安全」的假設極其危險。
人工智能供應鏈審計五步檢查清單
應以審視任何關鍵互聯網服務同等標準對待人工智能端點。請從以下步驟開始：
- 盤點與發現：識別所有人工智能相關服務，包括推理端點、模型儲存庫（例如使用MLflow、Seldon或Hugging Face），以及Kubernetes或容器叢集的管理介面。
- 存取審查：針對每個發現的端點，立即驗證是否已啟用並強制執行認證機制。
- 網絡評估：確保服務未不必要地暴露於公共互聯網。應將服務置於安全內部區段，僅可通過VPN或私有連接訪問。
- 配置加固：審閱所有人工智能框架的預設設定。停用不安全功能，並為管理面板設定強健且獨特的憑證。
- 持續監控：實施日誌記錄與警報機制，以偵測整個人工智能基礎設施中的未授權訪問或異常活動。
部署人工智能的驅力可以理解，但在未保障供應鏈安全的情況下倉促行動，只會轉移風險。數據顯示對許多機構而言，自託管的優勢目前實屬幻象，令珍貴資產與系統暴露於風險之中。