Key points
- SemiAnalysis says it broke isolation between customers at AI cloud providers while testing 25 companies and 32 clusters.
- Exposed data belonged to banks, telcos, universities, AI labs and one national intelligence agency. That provider patched within a week.
- The report names no vulnerable provider. CoreWeave (CRWV) and Microsoft's (MSFT) Azure appear only in a software-version check.
The most important AI story of the weekend isn't about chips. SemiAnalysis, the research shop everyone in this industry reads, spent four months testing 25 AI cloud providers across 32 clusters for its upcoming ClusterMAX 3.0 ratings, and it published the security findings early because of what it found along the way. In several cases its testers reached data belonging to other customers on the same infrastructure: banks, telecom companies, universities, AI labs, and in one instance "a national intelligence agency from a country with a top-10 global GDP."
That provider patched it within a week of being told, and SemiAnalysis went back and verified the fix. Credit where it's due.
The scary part isn't the hacking
Much of what they did wasn't sophisticated. That's the part I can't get past. "We have found quite a few dead simple vulnerabilities. We have not developed anything novel," the report says. Some of the bugs had public write-ups more than three years old, and in a lot of cases the entire test was checking whether a provider's software was older than the version the vendor said was the safe minimum.
It was.
The whole industry has spent 2026 arguing about AI super-hackers, and that fear isn't fake. OpenAI's own models broke out of a test sandbox and into Hugging Face's production systems this summer, which SemiAnalysis recaps in detail. But when the firm went digging through vulnerability data for proof that AI has fundamentally changed the pace of cyberattacks, it says it mostly couldn't find the effect. What it found instead was GPU clouds running years-old software with publicly documented container escapes. The futuristic threat gets the headlines. The 2023 threat gets your data.
| What it says it reached | How |
|---|---|
| Other tenants' metadata | Server management networks left open, missing network segmentation, misconfigured InfiniBand security keys |
| Root access on the shared host | Container escape using an NVIDIA bug disclosed in 2025 |
| Other tenants' data | Kubernetes services with no default-deny network policy, and a kubelet reachable on a public address |
| Cross-tenant remote code execution | All of the above chained together at a single provider |
A different provider produced the worst finding. It built shared Kubernetes control planes against the documentation of its own software, ran cluster software that was more than two years out of date, and left the kubelet reachable on a public IP. SemiAnalysis chained those weaknesses into a working cross-tenant attack in an afternoon and demonstrated it between two accounts it controlled itself, then spent months following up until the provider fixed it.
The monitoring failure may be the most revealing example. A provider gave SemiAnalysis a Grafana dashboard that accidentally showed someone else's machine on it. When the firm dug in, the real problem was uglier: every customer's dashboard was querying the database with a key that could read logs and metrics from every tenant on the platform. The separation between customers only existed at the display layer. Behind it sat GPU utilization, project names and inference stats for everyone, including that intelligence agency.
