ShadowRay: Hijacking the AI Compute Behind Ray Clusters
The first attack campaign that went hunting specifically for AI compute — and found thousands of clusters wide open.
| When | March 2024 (campaign disclosure) |
|---|---|
| Target | Ray AI compute clusters |
| Researcher | Oligo Security (Lumelsky, Kaplan, Elbaz) |
| Technique | Unauthenticated Jobs API abuse |
| CVE | CVE-2023-48022 — CVSS 9.8 (NVD-disputed; opt-in auth since Ray 2.52) |
- 1Attackers scan for internet-exposed Ray dashboards / Jobs API (no auth)
- 2They submit jobs that run arbitrary code on the cluster
- 3They mine cryptocurrency and steal tokens, keys and credentials, with models exposed too
What happened
In 2024, Oligo Security documented ShadowRay — what it called the first in-the-wild campaign hunting AI workloads. Attackers exploited a missing authorization check on Ray's Jobs API (CVE-2023-48022) to run code on thousands of internet-exposed Ray servers, some compromised for months. A follow-on wave ('ShadowRay 2.0') was reported in November 2025; Ray has since added opt-in token authentication (version 2.52), switched on by default for local clusters from version 2.59.
How the attack worked
Ray's dashboard and Jobs API accept job submissions without authentication. Anyone who could reach the port could submit a job that executes arbitrary code on the cluster. Attackers used that to deploy cryptominers, and the compromised clusters exposed OpenAI and Hugging Face tokens, SSH keys, database credentials and AI models.
'Disputed', but exploitedAnyscale considers the unauthenticated API intended behaviour requiring network isolation, so CVE-2023-48022 is NVD-disputed, with no fix beyond opt-in authentication added in late 2025 — yet exposed clusters were compromised at scale.
Root cause
A powerful compute framework left unauthenticated by design and then exposed to the internet — with high-value AI secrets sitting inside it.
Why it matters
The AI stack is now a named target. Attackers went after Ray precisely because that's where GPUs, model weights and provider tokens live.
How to prevent it
- Never expose a Ray dashboard / Jobs API to the internet.
- Enforce network isolation and authentication in front of it.
- Rotate any tokens or keys reachable from the cluster.
FAQ
Why is the CVE 'disputed'?
Anyscale argues the Ray Jobs API was intentionally unauthenticated and must be protected by network isolation, so there was no patch; Ray only added opt-in token authentication in version 2.52 (November 2025). NVD flags CVE-2023-48022 as disputed — but exposed clusters were still exploited at scale, so the operational risk is real regardless of the label.
Why does this belong in an AI incident database?
It's the first documented in-the-wild campaign specifically hunting AI workloads — attackers went after Ray because that's where GPUs, model weights and provider tokens live. The prize was the AI stack itself.
How do you defend?
Never expose a Ray dashboard/Jobs API to the internet; enforce network isolation and authentication in front of it, and rotate any provider tokens or keys reachable from the cluster.
Sources
- ShadowRay: First Known Attack Campaign Targeting AI Workloads Actively Exploited in the Wild — Oligo Security
- CVE-2023-48022 — NVD
- ShadowRay 2.0: Attackers Turn AI Against Itself in Global Campaign that Hijacks AI Into Self-Propagating Botnet — Oligo Security
- Ray token authentication — Ray documentation