Use case sources
Source reports and analysis supporting this case are listed below. AITBM interpretation and any indicative scoring are derived from this public evidence.
- AIDEFEND SecureFlow — ShadowRay: Hijacking Exposed Ray Clusters
- MITRE ATLAS case study AML.CS0023
- Anyscale Update on CVEs (anyscale.com)
- CVE-2023-48022 (nvd.nist.gov)
- ShadowRay: First Known Attack Campaign Targeting AI Workloads Actively Exploited In The Wild (oligo.security)
- ShadowRay: AI Infrastructure Is Being Exploited In the Wild (protectai.com)
Oligo observed attackers using unauthenticated exposed Ray Jobs APIs to run jobs and reverse shells on production Ray clusters. Its evidence includes an AI model actively answering a query on one compromised cluster, so a representative production model served by that affected cluster is bounded; the model type and any alteration of its outputs are not established.
ASSESSED SYSTEM
Representative production AI model actively serving a query on an Oligo-observed compromised Ray cluster, inheriting the exposed, unauthenticated Ray Jobs API as its host control boundary. Model architecture is not identified.
OUT OF SCOPE
Other Ray clusters, all Ray versions, specific named models or customers, altered model outputs, model theft, and the disputed CVE-2023-48022 score are outside this bounded assessment.
Architecture: Traditional ML / Classifier (decision tree Q6) — Q1–Q5 cannot be established from the model description. Q6 fallback is used for a model of unspecified type solely to select representative weights; it does not assert the model was a classifier. Tier 2: Tier 2 representative production model-serving scenario. Oligo does not identify the operator, users, or exact deployment tier; this is a comparison scenario.
Documented attack or failure path
- An internet-reachable Ray Jobs API accepted jobs without caller authentication on an affected production cluster.
- Attackers submitted jobs that executed commands and reverse shells on the cluster host.
- Oligo observed a production AI model serving a query on compromised infrastructure; it did not demonstrate model tampering.
Observed controls and bounded outcomes
Positive credit is given only where the record directly demonstrates a control operating. Recommended or merely presumed controls receive no positive scoring credit.
- Ray maintainers document deployment behind a trusted network or authenticating proxy; these are remediation controls and are not credited to the observed exposed state.
Layer 1 — Intrinsic Vulnerability Profile
Each sub-metric is placed on its five-level rubric by the evidence quoted beside it. Missing applicable evidence remains unknown. The displayed midpoint and interval are scenario values, not inferred control performance.
| Sub-metric | Score | Rubric basis | Evidence |
|---|---|---|---|
| Robustness (Ro) — scenario interval 0.00–1.00 (midpoint 0.50), Tier 2 MVT 0.50 indeterminate | |||
| Fairness (Fa) — scenario interval 0.00–1.00 (midpoint 0.50), Tier 2 MVT 0.55 indeterminate | |||
| Transparency (Tr) — scenario interval 0.00–1.00 (midpoint 0.50), Tier 2 MVT 0.50 indeterminate | |||
| Privacy (Pr) — scenario interval 0.00–1.00 (midpoint 0.50), Tier 2 MVT 0.55 indeterminate | |||
| Containment (Cn) — scenario interval 0.00–0.70 (midpoint 0.35), Tier 2 MVT 0.55 indeterminate | |||
| Cn-1Scope Enforcement | 0.00w 0.22 | The exposed host control path had no effective boundary against unauthorized code execution, directly matching the 0.00 Cn-1 anchor. | Oligo observed unauthenticated Ray Jobs execution on clusters including infrastructure hosting an active production model.source: primary report |
| Cn-5Agent Identity Integrity | 0.00w 0.08 | An unauthenticated caller could invoke the job control interface, directly matching the 0.00 Cn-5 anchor for this tool/workload boundary. | The affected Ray Jobs API accepted calls without caller identity verification or authentication.source: primary report |
Unknown, not N/A: 22 applicable sub-metrics lack admissible public evidence. The lower, midpoint, and upper scenarios evaluate each at 0.00, 0.50, and 1.00 respectively; no weight is redistributed merely because evidence is missing.
Architecture-based NOT APPLICABLE: NOT APPLICABLE by design for this architecture class: Cn-8, Cn-9.
Layer 2 — Operational Risk Posture
| Dimension | Score | Justification |
|---|---|---|
| AaAutonomy Amplification | 0.25w 0.25 | Representative activity level for the documented bounded AI path; deployment-specific autonomy was not measured. |
| AsAttack Surface Exposure | 1.00w 0.35 | Representative exposure of the documented entry path; this is a scenario assumption and not a census of all operators. elevated |
| CpCascade Potential | 1.00w 0.20 | No verified System Dependency Graph or DGC is published, so framework worst-case Cp default applies.GDCP: worst-case default — no verified dependency graph published elevated |
| RfRemediation Feasibility | 0.50w 0.20 | A specific patch or configuration change is documented; repair feasibility is an inferred representative scenario, not measured recovery time. |
Nelevated = 2 (dimensions strictly above 0.75) → CRM = 1.15.
Compound Risk Alert. Two or more dimensions are simultaneously elevated (spec 3.2.2); architectural decomposition is recommended before deployment.
Layer 3 — Public-evidence confidence diagnostic
| Component | Score | Basis |
|---|---|---|
| Pc — Public provenance evidence | 0.25 | Minimal public provenance identifies the affected path but supplies no operator assessment pack, signed configuration inventory, or repeated metric battery. |
| Ec — Public evaluation coverage | 0.07 | coverage 0.08 (2 of 24 applicable sub-metrics) × independence 0.80 × fidelity 1.00. No Full, Standard, or Lite pathway is claimed for a retrospective article. |
| Tf — Public-evidence freshness | 0.00 | Evidence dated 2024-03-26; age 936 days on the workpaper reference date. Components: T_calendar 0.00 · C_event 0.35 · C_monitor 0.60. Binding term: T_calendar. Evidence reference is 2026-10-18, 936 days after earliest substantive public evidence (2024-03-26). C_monitor uses the conservative Tier 2 public-evidence default because usable monitoring-coverage evidence is unavailable; it does not assert no deployment telemetry. C_event = 0.35 reflects the directly observed intrusion; no targeted post-event re-attestation is published for the bounded pre-fix path. No generic C_evidence cap is assigned from missing public inputs. Indicative ERS uses normalized ACI = 1.00 for comparison only. |
Public-evidence ACI = (Pc × Ec × Tf)1/3 = 0.02 — diagnostic status: Invalid as assessment-of-record evidence. It describes the evidence available to this case study, not the assurance of the underlying system, and is not inserted into the normalized-assurance scenario ERS.
Indicative ERS — normalized-assurance scenario
Published CVSS beside indicative ERS
Each published CVSS record is shown exactly as its scorer published it, one per vulnerability record, with the version, metric group and vector when stated, plus its source and access date. Records are never combined or inferred from a CVE's existence.
INDICATIVE ERS · NORMALIZED-ASSURANCE SCENARIO
4.8 midpoint, interval 1.4–8.2; Low-Moderate scenario band; ACI fixed at 1.00. The published CVSS records do not enter this calculation.
PUBLISHED CVSS
CVSS — no applicable published score verified.
Oligo references disputed CVE-2023-48022 and a 9.8 score, but the observed clusters have no common verified affected version or CVE variant. No score matches this representative assessed path with sufficient precision.
CVSS describes an individual vulnerability as its scorer published it. Indicative ERS describes the assessed AI deployment under the normalized-assurance scenario, so the two values are not direct equivalents and neither replaces the other.
AIDEFEND defences → AITBM sub-metrics
Identifiers are quoted as they appear on the AIDEFEND in Action brief or in the AIDEFEND SecureFlow defense map (audited AIDEFEND dataVersion 2026.10.15); the sub-metric mapping is AITBM's own, from the specification's AIDEFEND tables reconciled at catalogue data version 2026.10.15. AIDEFEND renumbers identifiers between releases, so the data version travels with every mapping and neither side's IDs should be cited without one. A mapping identifies a possible evidence route; a recommendation does not prove that the control was implemented or effective and receives no scoring credit by itself.
| Technique | Defence | Priority | Evidences |
|---|---|---|---|
| AID-I-002.001 | Internal AI Network SegmentationExact SecureFlow defense-map identifier (flow atlas-aml-cs0023-shadowray-exposed-cluster-exploitation), verified against AIDEFEND dataVersion 2026.10.15; matched to attack steps step-1, step-3. Presence supplies no score credit. | Candidate evidence route | Cn-4 |
| AID-M-001.005 | Public AI Endpoint & Agent-Service Exposure DiscoveryExact SecureFlow defense-map identifier (flow atlas-aml-cs0023-shadowray-exposed-cluster-exploitation), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-1. Presence supplies no score credit. | Candidate evidence route | Fa-3 Tr-4 Cn-5 |
| AID-H-004.002 | Service & API AuthenticationExact SecureFlow defense-map identifier (flow atlas-aml-cs0023-shadowray-exposed-cluster-exploitation), verified against AIDEFEND dataVersion 2026.10.15; matched to attack steps step-2, step-4. Presence supplies no score credit. | Candidate evidence route | Tr-3 Cn-5 |
| AID-D-005.003 | Proactive AI Threat HuntingExact SecureFlow defense-map identifier (flow atlas-aml-cs0023-shadowray-exposed-cluster-exploitation), verified against AIDEFEND dataVersion 2026.10.15; matched to attack steps step-3, step-5. Presence supplies no score credit. | Candidate evidence route | Tr-3 Cn-7 |
| AID-E-001.001 | Root & Long-Lived Credential Object EvictionExact SecureFlow defense-map identifier (flow atlas-aml-cs0023-shadowray-exposed-cluster-exploitation), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-4. Presence supplies no score credit. | Candidate evidence route | Cn-5 |
| AID-E-001.002 | Issued Token, Authentication Session & Lease RevocationExact SecureFlow defense-map identifier (flow atlas-aml-cs0023-shadowray-exposed-cluster-exploitation), verified against AIDEFEND dataVersion 2026.10.15; matched to attack steps step-4, step-6. Presence supplies no score credit. | Candidate evidence route | Cn-5 |
| AID-I-002.002 | Secure External AI Service ConnectivityExact SecureFlow defense-map identifier (flow atlas-aml-cs0023-shadowray-exposed-cluster-exploitation), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-5. Presence supplies no score credit. | Candidate evidence route | Cn-4 |
| AID-H-003.006 | Model SBOM & Provenance AttestationExact SecureFlow defense-map identifier (flow atlas-aml-cs0023-shadowray-exposed-cluster-exploitation), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-6. Presence supplies no score credit. | Candidate evidence route | Ro-4 Ro-5 Tr-4 |
| AID-D-004.001 | Static Artifact Integrity Re-verification & Drift MonitoringExact SecureFlow defense-map identifier (flow atlas-aml-cs0023-shadowray-exposed-cluster-exploitation), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-6. Presence supplies no score credit. | Candidate evidence route | Ro-5 Tr-3 Cn-7 Cn-9 |
| AID-D-005.007 | Token, Tool-Use, Request-Parameter & Cost Spike Detection & AlertingExact SecureFlow defense-map identifier (flow atlas-aml-cs0023-shadowray-exposed-cluster-exploitation), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-7. Presence supplies no score credit. | Candidate evidence route | Tr-3 Cn-7 |
WHAT THIS CASE TEACHES
A production model was observed on exploited Ray infrastructure, permitting a narrowly bounded host-inheritance score for the unauthenticated Jobs path; no model tampering is evidenced.
Sources: AIDEFEND SecureFlow — ShadowRay: Hijacking Exposed Ray Clusters · MITRE ATLAS case study AML.CS0023 · Anyscale Update on CVEs (anyscale.com) · CVE-2023-48022 (nvd.nist.gov) · ShadowRay: First Known Attack Campaign Targeting AI Workloads Actively Exploited In The Wild (oligo.security) · ShadowRay: AI Infrastructure Is Being Exploited In the Wild (protectai.com)