AI Infrastructure Attack Surface: Where Can RCE Happen?

AI application testing often stops at prompts. This laboratory treats serving stacks as ordinary networked software. Public 2026 reports of untrusted object decoding on inference HTTP or RPC paths are why this map exists.

We ask where code execution can happen. We do not publish how to trigger a specific serving bug.

The vulnerability classes are familiar: untrusted deserialization, unsafe model/artifact load, exposed admin RPC, plugin code load, and sandbox escape. What is new is that these now sit on GPU nodes and “demo” ports that teams leave reachable.

Inference frameworks, model hubs, agent runtimes, vector-database sidecars, training-job controllers, and any HTTP or ZMQ front end that wraps a runtime.

Ten surfaces we inventory on every AI stack: framework core, inference server, model loading, serialization, RPC, ZMQ, public API, plugin system, sandbox, and container/orchestrator API.

The failed assumption is “this port is only for our notebook.” Root cause is a network-facing decoder or loader that still believes it is local.

Pick one surface and fill the boxes with real module names from a public tree before you claim a finding.

It becomes RCE when the front end accepts a construction plan (pickle, arbitrary torch class, plugin wheel) or when RPC methods can start processes. Prompt injection that stays inside generated text is not this class. Keep the two research lines separate.

Serving-stack patches in this class usually disable pickle, bind to localhost, add auth tokens, or move loaders behind signed artifacts. Read whether the default install is still unsafe. Defaults are the real surface.

Inventory listening ports on GPU nodes. Search for pickle, marshal, eval, torch.load without weights_only, and plugin entry points. Confirm which of those are bound to non-loopback interfaces.

Do not expose inference admin or load APIs to the internet. Require auth on every RPC. Load only signed, inert weight formats. Run workers as non-root with no host docker socket. Treat plugins as code deploy.

A researcher who only talks about prompts will miss the RCE on port 30000. A researcher who only talks about ports will miss authorization in the app. This laboratory does both — and labels them differently.

Public vendor advisories on inference and serving stacks — cited per CVE once official.

OWASP guidance on untrusted deserialization — still the right class name.

Art of Vector Security disclosure policy — /about/responsible-disclosure.