CVE-2023-48022: what its weaponization means for AI infrastructure

TL;DR: CVE-2023-48022 has moved from ShadowRay-style exploitation into commoditized botnet tradecraft, with established families reusing a missing-authentication flaw in the Ray Jobs API to run arbitrary code, harvest secrets and drive cryptomining, DDoS and exfiltration, according to TXOne Networks research. The practical lesson is that exposed AI infrastructure needs identity, network and runtime controls before attackers turn it into a reusable launchpad.

Editorial analysis by NHI Mgmt Group, based on content published by TXOne Networks: “AI Infrastructure Under Siege: Multiple Threat Actors Weaponize CVE-2023-48022”.

By the numbers:

• Our telemetry shows Q4 2025 total activity reached 803, with 45 in October, 386 in November and 372 in December.

Key questions

Q: What breaks when AI endpoints are exposed without authentication?

A: Unauthenticated AI endpoints become discoverable services that attackers can validate, abuse for inference, and resell as access.

Q: Why do exposed AI clusters make secret harvesting so easy?

A: Because workloads often inherit secrets through environment variables, mounted files and orchestration metadata.

Q: How can security teams tell when AI infrastructure is being used for botnet activity?

A: Look for shell-cascade execution, unexpected script downloads, background daemons, cron creation and unusual CPU or GPU consumption.

Practitioner guidance

• Enforce authenticated access to AI control planes Require OIDC or mTLS for Ray-style dashboards and job APIs, and remove any internet exposure that is not strictly necessary for operations.
• Strip secrets from job environments Move credentials out of environment variables and job payloads, then rotate anything that may already have been exposed through a recon payload.
• Hunt for download-and-execute patterns Alert on wget to sh, curl to bash, direct shell piping and similar process chains in AI job submissions and runtime logs.

Bottom line: The article describes a shift from a one-off AI vulnerability to a repeatable abuse pattern that attackers can automate across exposed clusters.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →