In the wild
Realized harm
ShadowRay 2.0: exposed Ray AI clusters hijacked into a self-propagating botnet with LLM-generated payloads
AIR-2025-0163 AIR record · 2025-11-oligo-shadowray-2
A real party was affected. This incident caused actual consequences, not a demonstrated capability.
From the supporting source
LLM-generated payloadsoligo.security
The record
Disclosed
2025-11
Occurred
2025-09
Vendor
Anyscale
Product
Ray (Anyscale) clusters
Risk domain
Access control and permissions › Confused deputy
System type
Generative model
Who acted
AI was the target — exposed Ray clusters hijacked via an unauthenticated jobs API
Attack surface
Agent framework
Autonomy level
Assistant
Initial vector
Unauthenticated ray jobs api on exposed dashboards
Impact type
Infrastructure compromise, Cryptomining, Data theft
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI03 – Identity and Privilege Abuse
- MITRE ATLAS
- AML.T0054 – LLM Jailbreak
- NIST AI RMF
- GOVERN 6.1
- EU AI Act
- —
- ISO/IEC
- TR 24028; 42001; 23894
- AIUC-1
- B. Security
- Scope
- tool misuse
- Mitigation
- Validate delegation chains; Use signed attestations.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
230,000+ Ray servers exposed to the internet; confirmed compromises across multiple continents including clusters worth millions in annual compute
Capability abused
Defense & remediation
Recorded defense
None by default - Ray ships without authentication
Guardrail kinds
None
Guardrail outcome
Not applicable
Fix shipped
No patch; the CVE is disputed by Ray maintainers as intended behaviour for trusted environments
Taxonomy & references
Curator notes
Second wave of the March 2024 ShadowRay campaign. The AI angle is twofold and both parts should be read narrowly: the victims are AI compute clusters, and Oligo infers from code style, comments and error handling that the payloads were LLM-written - which is suggestive, not proof. The 230,000 exposure figure is internet-wide scanning, not compromise count. Oligo later linked this campaign to TeamPCP, the same cluster GTIG ties to the LiteLLM supply-chain compromise. Anyscale disputes CVE-2023-48022 as a vulnerability at all. Only month-level precision was verified for the Oligo publication date (early November 2025).
Supporting sources
Cite as
Enkrypt AI. "ShadowRay 2.0: exposed Ray AI clusters hijacked into a self-propagating botnet with LLM-generated payloads". AIR, AIR-2025-0163. https://agentincident.vercel.app/i/AIR-2025-0163/ (accessed 2026-10-19).