AI Data Centres Are Being Built at Speed. Security Is Not Keeping Up.

Key points

• Security firm Lava Labs published a report in 2025 identifying ten ranked security risks specific to AI data centres, which it calls the "Forge" list.
• AI data centres handle workloads from many unrelated companies at once, meaning a single breach can spill across customers with no connection to each other.
• The five highest-ranked risks operate below the operating system level, making them extremely hard to detect and capable of taking down an entire cluster of machines.
• GPU processors, the specialist chips that power AI, are often sourced from whatever suppliers are available, which can introduce hardware with weaker security built in from the start.
• Lava Labs concludes that builders are treating AI facilities like upgraded traditional data centres, which they are not.

A data centre is, at its simplest, a building full of computers that store and process information on behalf of other organisations. For decades the model was stable: known customers, predictable workloads, servers that mostly worked independently of each other.

AI broke that model, and the break is structural. These workloads need enormous computing power delivered all at once, which requires thousands of GPUs (graphics processing units, the chips originally designed for video games and now repurposed for AI calculations) working together as a single coordinated machine. The customers sharing that machine may be completely unrelated businesses running code side by side.

Lava Labs spent time examining what that shift means for security, and the findings are uncomfortable for anyone building or buying capacity in these facilities.

Could one customer's data end up exposed to another customer's staff?

Yes, that is precisely the risk Lava Labs flags most prominently. When unrelated companies share the same physical hardware and that hardware gets reassigned between them, the walls between those customers need to be airtight. In practice, Lava Labs found, they frequently are not.

The firm ranked ten risks in order of severity, labelling them Forge 01 through Forge 10. Forge 01 through 05 are the ones that should keep facility operators awake at night. They operate below the operating system, meaning below the layer most security tools even look at. Firmware, the low-level software permanently installed on a piece of hardware, can be tampered with in ways that leave no obvious trace. The high-speed internal networks connecting GPU clusters, products such as InfiniBand and NVLink, often carry data without encryption and with little monitoring. A criminal who gets a foothold there can move sideways across an entire facility.

The failure mode is straightforward. Builders are copying the design playbook from traditional data centres because it's the playbook they know. Lava Labs states directly that systems originally built for trusted operators are now running high-value workloads from strangers.

We covered a related failure pattern on 16 July in "Give an AI a Body and You Give It an Attack Surface", where warehouses were deploying physical AI systems without a single audit standard in place. The dynamic here is the same: infrastructure racing ahead of the security thinking that should accompany it.

Should you worry even if you never touch these facilities directly?

You should. If your bank, your retailer, or the NHS trust that holds your records runs AI services inside one of these facilities, a breach at the infrastructure level could reach their data without anyone breaking into their own systems at all.

The practical step is the same one that always applies: watch for unexpected communications from companies you use, and report anything suspicious to them directly.

What this actually tells me is that the post-mortem template is already written. When a major multi-tenant GPU cluster gets compromised at firmware level, the finding will be that nobody thought the old data centre rulebook needed rewriting before they started building.