AI Security Atlas › All entries › Model Supply Chain & Training Integrity
Unrestricted Inference Endpoints
Inference APIs expose logprobs, embeddings, or unlimited throughput to any authenticated or anonymous caller.
Open in the interactive atlas →Impact
Enables extraction, membership inference, and cost harvesting at scale.
Why this severity
Impact Medium × Likelihood High = High
Impact medium: enables extraction and cost abuse rather than direct compromise. Likelihood high: exposed, unauthenticated AI infrastructure was hijacked in the ShadowRay incident.
Impact Medium: Limited or recoverable harm: cost, availability, reputational damage, or exposure confined to one session or user.
Likelihood High: At least one documented real-world incident, and the attack needs no access beyond what the system exposes to ordinary users or content (publishing to a public registry counts as ordinary).
Method: OWASP Risk Rating Methodology
Evidence
- Incident: ShadowRay: Hijacking Exposed Ray Clusters (MITRE ATLAS case study AML.CS0023, 2023)
- Incident: Model Distillation Campaigns Targeting Anthropic Claude (MITRE ATLAS case study AML.CS0056, 2026)
Related
Exploited by
- Model Extraction via Inference API Threat · High severity
Mitigated by
- Inference Quotas & Output Watermarking Guardrail · Fixes high risks
Remediation
- Rate-limit by key, IP, and organization with burst controls.
- Gate logprobs and raw embeddings behind explicit scopes.
- Alert on query patterns that sweep the input space systematically.
How to verify
- Anonymous callers receive 401 on every inference route.
- Quota exhaustion returns 429 before backend saturation.
Framework mapping
OWASP Top 10 for LLM Applications 2025
- LLM10:2025 Unbounded Consumption
MITRE ATLAS
NIST AI RMF 1.0
- MEASURE 2.7 AI system security and resilience are evaluated and documented