ShadowRay: Hijacking the AI Compute Behind Ray Clusters
The first attack campaign that went hunting specifically for AI compute — and found thousands of clusters wide open.
| When | March 2024 (campaign disclosure) |
|---|---|
| Target | Ray AI compute clusters |
| Researcher | Oligo Security (Lumelsky, Kaplan, Elbaz) |
| Technique | Unauthenticated Jobs API abuse |
| CVE | CVE-2023-48022 — CVSS 9.8 (NVD-disputed; no patch) |
- 1Attackers scan for internet-exposed Ray dashboards / Jobs API (no auth)
- 2They submit jobs that run arbitrary code on the cluster
- 3They mine cryptocurrency and steal tokens, keys, credentials and models
What happened
In 2024, Oligo Security documented ShadowRay — what it called the first in-the-wild campaign hunting AI workloads. Attackers exploited a missing authorization check on Ray's Jobs API (CVE-2023-48022) to run code on thousands of internet-exposed clusters, some compromised for months. A follow-on wave ('ShadowRay 2.0') was reported in November 2025.
How the attack worked
Ray's dashboard and Jobs API accept job submissions without authentication. Anyone who could reach the port could submit a job that executes arbitrary code on the cluster. Attackers used that to deploy cryptominers and to steal OpenAI and Hugging Face tokens, SSH keys, database credentials and AI models.
'Disputed', but exploitedAnyscale considers the unauthenticated API intended behaviour requiring network isolation, so CVE-2023-48022 is NVD-disputed and unpatched — yet exposed clusters were compromised at scale.
Root cause
A powerful compute framework left unauthenticated by design and then exposed to the internet — with high-value AI secrets sitting inside it.
Why it matters
The AI stack is now a named target. Attackers went after Ray precisely because that's where GPUs, model weights and provider tokens live.
How to prevent it
- Never expose a Ray dashboard / Jobs API to the internet.
- Enforce network isolation and authentication in front of it.
- Rotate any tokens or keys reachable from the cluster.
FAQ
Why is the CVE 'disputed'?
Anyscale argues the Ray Jobs API is intentionally unauthenticated and must be protected by network isolation, so there is no patch. NVD flags CVE-2023-48022 as disputed — but exposed clusters were still exploited at scale, so the operational risk is real regardless of the label.
Why does this belong in an AI incident database?
It's the first documented in-the-wild campaign specifically hunting AI workloads — attackers went after Ray because that's where GPUs, model weights and provider tokens live. The prize was the AI stack itself.
How do you defend?
Never expose a Ray dashboard/Jobs API to the internet; enforce network isolation and authentication in front of it, and rotate any provider tokens or keys reachable from the cluster.