Every layer of modern infrastructure is observable and has security controls, except for the stack supporting your AI runtime. Our research team probes real hardware and the software and frameworks around it. We reproduce and find new attacks, then show what it takes to catch them.
Our full write-ups are technical, written for your security engineering and infrastructure architecture teams. This page is the learnings abbreviated: what we found and why it matters.
It’s organized by the outcome you care about, and we update it every time we publish.
Outcome: Protect production AI before the patch lands #
"How exposed are we until every host is patched?"
Inference is where your AI meets your customers, and training is where your GPU spend goes. Stealthium prevents, detects and responds to attacks on the infrastructure that runs both, often before the patch lands and sometimes before the vulnerability is even public.
Beyond our typical detections, we ship coverage for flaws we find while they are still under coordinated disclosure. Customers are covered today for over 10+ Critical or High severity vulnerabilities we have reported that are not yet public.
Additionally, accelerators can have long maintenance cycles, and are at times beyond your control and in the hands of your hypervisor or neocloud. In August 2026, an independent audit of 25 neocloud providers found NVIDIAScape (CVSS score 9.0), patched in July 2025, still exploitable at one of them.
Stopping A Two-Faced Greedy Guest: How Stealthium Protects Against Januscape · July 2026
Risk: A tenant on a shared GPU host can break out of their virtual machine and take control of the host.
At stake: Every other tenant's models, data and training runs on that host, via a layer you have no security visibility for.
Stealthium: Prevents, on hosts not yet patched: the only publicly documented runtime prevention.
Ask your provider:
"If a tenant escaped onto a host we share, what would you see, and how fast would you tell us?"
GPUBreach: A Root Shell Through GPU Abuse · April 2026
Risk: A flaw in NVIDIA's GPU driver lets an attack that starts on the GPU end with full control of the host server.
At stake: The host and every workload on it. The hardware designed to fence the GPU off does not stop it.
Stealthium: Detects, and customers can search their history for past attempts.
Ask your provider:
"Which NVIDIA driver version are our hosts running today, and how long do security fixes take to reach them?"
Root on Every GPU Container Start: Catching NVIDIA Container Toolkit Compromise · August 2026
Risk: The NVIDIA software that connects every container to a GPU runs with full host privileges, and has had five vulnerabilities since 2024 (including NVIDIAScape).
At stake: One malicious container start can mean control of the host and everything running on it. Most detection rules watch the wrong part of this software.
Stealthium: Detects, telling legitimate activity from abuse.
Ask your provider:
"How do you detect abuse of the NVIDIA Container Toolkit on our hosts, beyond keeping it patched?"
Tell Me About Your(GPU)self: Catching CVE-2026-47483 In A Working Day · October 2026
Risk: Anyone who can reach a standard NVIDIA GPU monitoring component can crash it and read some of its internals.
At stake: Your visibility into that GPU host. An attacker can blind your monitoring before doing anything else, using traffic that looks routine.
Stealthium: Detects, from first contact. Coverage shipped the same working day the attack method went public.
Ask your team:
"If GPU monitoring went dark on a host, how fast would we know, and would we know why?"
Outcome: Preserve model integrity and IP #
"How do we know the model in production is the one we approved?"
Your model is your most valuable asset and, increasingly, your liability. The model you validated should be the one answering your customers, and your weights should stay yours.
Hands Off: Detecting Model Weight Tampering · October 2026
Risk: Someone who can run code alongside your model can change how it answers by rewriting it in memory, without touching the file on disk.
At stake: Customers get different answers from a model that passes every integrity check you run.
Stealthium: Detects tampering attempts. Pinpointing exactly what changed is ongoing research.
Ask your team:
"Beyond checking the model file, how would we know if the model in memory had been changed?"
Your GPU Can Be Rooted From Inside a CUDA Kernel. Here Is Exactly How. · April 2026
Risk: An unprivileged process on a shared GPU can read and write everything in that GPU's memory. No special permissions are needed.
At stake: Model weights stolen or poisoned, and inference data, including private user data, exposed.
Stealthium: Prevents, stopping the attack before it reaches sensitive memory.
Ask your provider:
"Is ECC memory enabled on the GPUs we share, and what stops another tenant reading our GPU memory?"
Outcome: Prove tenant isolation to customers and auditors #
"Can you prove our data is isolated from other tenants?"
Shared GPUs are how neoclouds make their margin and how enterprises get capacity. Both need evidence that isolation holds while workloads run, not a configuration that says it should.
Investigating Behind Bars and Return of a Nosy Neighbor · August and September 2026
Risk: A tenant sharing a partitioned GPU can tell which AI model their neighbor is running, with 97% accuracy in our tests. They can go on to learn its size and speed, and whether it is generating text, code or structured data.
At stake: What you run, and how, exposed to whoever rents the slice next door. Your model architecture and workload mix are competitive information, and partitioning a GPU is not the same as isolating it.
Stealthium: Detects the probing.
Ask your provider:
"Who else shares the physical GPUs we run on, and what runtime evidence shows the partitions hold?"
Outcome: Account for every workload on your GPUs #
"What is actually running on the GPUs we pay for?"
GPUs are the most expensive and least visible part of most AI infrastructure. Unauthorized jobs and stolen compute hide behind a dashboard that only shows the GPU is busy.
ShadowRay 2.0: Turning Exposed Ray Clusters Into a GPU-Mining Botnet · August 2026
Risk: Attackers take over exposed AI compute clusters to mine crypto on your GPUs, steal cloud credentials and model weights, then spread. More than 175,000 such servers were exposed when we published.
At stake: Your GPU bill, your cloud accounts and your models. To CPU-focused tools it looks like a busy server, and the framework's maintainers do not plan a fix.
Stealthium: Detects and responds, including from GPU behavior alone.
Ask your team:
"Are any of our AI cluster dashboards reachable from the internet?"
See what's running on your GPUs #
Most security tooling either cannot see the findings above or cannot tell them apart from normal behavior. This page grows each time we publish: the newest research goes in the Latest slot, then joins the section it belongs to.
Book a demo to see what Stealthium finds on your GPUs.