Malicious Models and Shared Tenancy: Wiz's AI-as-a-Service Research

Through 2024, Wiz Research — notably Hillai Ben-Sasson and Sagi Tzadik — published a series of findings against AI-as-a-service platforms, consolidated in a Black Hat talk. The through-line is a single uncomfortable idea: on a platform that runs customer-supplied models, an AI model is not passive data. It is code, and code you run for strangers is a tenant-isolation problem.

The platforms exist to let anyone upload a model and have it served on shared infrastructure. That convenience is the attack surface. If the container running an uploaded model can be made to execute the uploader's code, and if the isolation between tenants is imperfect, one customer's malicious model can become a foothold into a neighbour's data.

Two concrete results

Against Replicate, disclosed in May 2024, Wiz achieved remote code execution by packaging a malicious model in the platform's container format, then showed a path toward cross-tenant access to other customers' private models, prompts, and results. Against SAP AI Core, in a July 2024 write-up they called SAPwned, the researchers moved laterally and reached cross-tenant cloud credentials and private artifacts spanning AWS, Azure, and SAP's own cloud services. Related work on Hugging Face, presented at Black Hat, extended the same malicious-model theme to another major provider.

The framing to keep accurate

This was responsible-disclosure research, and it should be described as such. The exploitation was performed by Wiz; the affected vendors applied fixes, and reported no evidence that real customer data had been accessed by malicious actors. The value of the work is the demonstrated path, not a body count. It maps out where shared-tenancy AI platforms are structurally fragile before criminals map it for you.

It also reframes a common assumption. Teams that would never run an unknown binary from the internet routinely pull models from public hubs and run them in production. The Wiz research is a reminder that the two acts are closer than they feel — a serialized model can carry an executable payload, and the platform running it is making a trust decision on your behalf.

The economics of the platforms explain why this is hard to fix. Their whole value proposition is to run arbitrary customer models cheaply, which pushes toward shared, densely-packed infrastructure rather than the expensive per-tenant isolation that would be safest. Every provider in this space navigates the same tension between cost and separation, and the strength of their isolation is largely invisible to the customer uploading a model. That is why Wiz's work matters beyond the specific bugs: it gives buyers a concrete question to ask. For teams consuming these services, the takeaway is not to avoid hosted AI — that ship has sailed — but to treat a provider's isolation architecture as a first-class part of due diligence, the way you would scrutinise a payment processor's segmentation.

What defenders should take away

• Treat third-party models as untrusted code. Prefer safe serialization formats, scan model artifacts, and run inference in strong sandboxes with no ambient credentials.
• Verify isolation on any AI platform you depend on. Ask providers how tenants are separated at the compute and credential layers, and weigh that in vendor selection.
• Deny the model standing secrets. An inference container should not hold long-lived cloud credentials that a cross-tenant escape could harvest.
• Catalogue where you run external models. Every hosted-model integration is a place this class of flaw could reach you.

Wiz's AI-as-a-service work turned an abstract worry into demonstrated attack paths against named platforms. For anyone building on hosted AI, the first control is simply knowing which providers run your models and how they keep tenants apart — because you cannot defend what you have not discovered.