Test the Reachable Service
Google’s 30 September 2026 study tallied 2,076 AI-related vulnerability disclosures, January 2025 through August 2026: few confirmed exploited flaws and no observed AI infrastructure attacks using an undisclosed vulnerability. These are visibility-limited observations, not universal safety.
BlackTree’s LightLLM example separates helper listeners from the model API. Exposure depends on network access and process privileges; research demonstrations do not establish attacks.
Map production and production-connected staging: user-to-model paths, hosts, builds, authentication, gateways, tools, secrets. Match enabled features/builds to advisories, not product names. Prioritise reachable unauthenticated code/file/key access; test gateway/network barriers. Give temporary controls owners/expiries.
Separate confirmed attacks, exploit availability, reachability and business impact. Contrast powerful gateways with local tools lacking untrusted input. Revisit exposure as exploit details spread; improve logging while restricting access.
Treat machine-generated findings as hypotheses: require reproducible paths, affected builds and vulnerable/fixed tests, not urgency labels. Preserve agent inputs/source revisions. Each cycle, baseline a small exposed set’s endpoints, rights, builds and logs. After patches/configuration changes, recheck builds, retest boundaries and inspect unexpected calls before closing tickets.
