Multiple unprotected AI large model servers exposed online
Research findings indicate that nearly 90% of privately deployed AI large model servers in China lack adequate security protections, with many using default open-source framework settings that disable password protection and omit firewall configuration. The Ministry of State Security identified three risk categories: sensitive data exposure, threats to critical infrastructure, and unauthorized user access, attributing the vulnerabilities to inadequate security awareness, insufficient staff training, and gaps in regulatory oversight.
What happened
Recent studies found that nearly 90% of privately deployed large model servers on the internet lack proper protection, with some models containing security vulnerabilities and susceptible to attacks.
Many organizations deploy large models using open-source frameworks with default settings that disable password protection for public network access, omit basic firewall configuration, and lack reasonable security measures, allowing attackers unauthorised access to model services and sensitive data.
Reported impact
Attackers can remotely call interfaces to steal model parameters, training data and knowledge bases, or delete and pollute private model files causing model failures or output errors.
If large models process excessive data volumes, servers may become paralysed due to GPU resource depletion. Malicious exploitation of deployment security flaws could cause public service interruptions, enterprise economic losses and safety incidents.
Index analysis
Organizational managers lack adequate cybersecurity awareness regarding AI safety, with some believing 'security is for experts', unaware that deploying AI services requires the same caution as protecting bank passwords.
Many enterprise security training programs are insufficient, resulting in employees lacking national security consciousness and awareness. China's existing laws on artificial intelligence and network data require further legislative development to address emerging legal issues.
Governance controls
The Ministry of State Security recommends organizations conduct comprehensive risk assessments and security planning before deploying large models, establish security policies, and conduct employee security training to enhance organisation-wide awareness.
AI enterprises should strengthen partnerships with security vendors, implement strict security technology safeguards and operational monitoring to enhance runtime security, reliability and stability of large models. Users should select large model tools only from official channels and avoid connecting to unknown networks.
Classification
Sources and evidence
Sources not yet published
This record was researched and written by the Index from original reporting. Its sources are still being verified by an editor, and they are listed here once that check is complete. Until then the record carries no reviewer.