LAS VEGAS — Wiz researchers warned that AI infrastructure providers like Hugging Face and Replicate are susceptible to novel attacks and must improve their defenses to protect sensitive user data.

During Black Hat USA 2024 on Wednesday, Wiz security researchers Hillai Ben-Sasson and Sagi Tzadik led a session that expanded on year-long research they conducted into three of the major AI infrastructure providers: Hugging Face, Replicate and SAP AI Core. The researchers tested whether they could break into the leading AI platforms and studied how easy it would be for attackers to gain access to confidential data.

The goal of the research was to assess the security of these platforms and determine the potential risks of storing valuable data in one of the top three AI platforms. As new AI technology has taken off, cybercriminals and nation-state actors alike have targeted third-party providers and platforms that host sensitive data and training models.

Hugging Face, a machine learning platform where users create models and store data sets, experienced a recent attack. In June, the platform detected suspicious activity in its Spaces platform, which required a key and token reset.

During the session, the researchers showed how they compromised the platforms by uploading malicious models and using container escape techniques to break out of their tenant and move laterally across the service. In an April blog post, Wiz researchers described how they were able to compromise Hugging Face and gain cross-tenant access to other customers’ data and training models. The cloud security vendor later published research on similar issues with Replicate and SAP AI Core, and they demonstrated the attack techniques during Wednesday’s session.

Prior to Black Hat, Ben-Sasson, Tzadik and Ami Luttwak, CTO and co-founder of Wiz, spoke with TechTarget Editorial about the session and lessons learned from the research. In all three cases, the researchers were able to hack Hugging Face, Replicate and SAP to access sensitive customer data.

“We accessed millions of confidential AI artifacts like models, data sets, code — unique intellectual property that can go for millions of dollars,” Ben-Sasson said.

Luttwak said many AI service providers use containers as barriers between different customers. But he stressed that those containers can be bypassed in many ways. For example, Luttwak said container services are prone to misconfigurations.

“There are all sorts of vulnerabilities that come out that will allow people to bypass these barriers. We think that containerization is not a secure enough barrier between tenants or tenant isolation,” Luttwak said.

Once the researchers discovered they could hack the platforms, they reported the issues to each service provider. Sasson applauded Hugging Face, Replicate and SAP for their disclosure responses. He said they were collaborative and professional, and Wiz researchers worked closely with their respective security teams to resolve the issues.

While the vulnerabilities and weaknesses were addressed by the providers, Wiz researchers recommended that organizations adapt their threat models accordingly to account for potential data compromises. As for the platforms, the researchers urged the AI service providers to improve their isolation and sandboxing standards to prevent threat actors from jumping to other tenants and moving laterally within the platforms.