Security analysis of assets hosted on major cloud providers’ infrastructure shows that many companies are opening security holes in a rush to build and deploy AI applications. Common findings include use of default and potentially insecure settings for AI-related services, deploying vulnerable AI packages, and not following security hardening guidelines.

The analysis, performed by researchers at Orca Security, involved scanning workloads and configuration data for billions of assets hosted on AWS, Azure, Google Cloud, Oracle Cloud, and Alibaba Cloud between January and August. Among the researchers’ findings: exposed API access keys, exposed AI models and training data, overprivileged access roles and users, misconfigurations, lack of encryption of data at rest and in transit, tools with known vulnerabilities, and more.

“The speed of AI development continues to accelerate, with AI innovations introducing features that promote ease of use over security considerations,” Orca’s researchers wrote in their 2024 State of AI Security report. “Resource misconfigurations often accompany the rollout of a new service. Users overlook properly configuring settings related to roles, buckets, users, and other assets, which introduce significant risks to the environment.”