CISA Adds Actively Exploited Ray AI Framework Flaw to Must-Patch List

Key points

• The U.S. Cybersecurity and Infrastructure Security Agency added a critical Ray vulnerability to its Known Exploited Vulnerabilities catalog on Monday.
• Ray is an open-source framework used by companies to run large artificial intelligence and machine learning jobs across many machines.
• CISA says the flaw is already being exploited in real attacks, though it has not named the groups behind them.
• Federal agencies must patch or stop using affected Ray installations under CISA's binding directive.
• Security researchers have previously tracked an exploitation campaign against exposed Ray clusters called ShadowRay.

The U.S. government's cyber agency is telling federal departments to patch a serious flaw in Ray, an open-source tool that companies use to run artificial intelligence workloads across many computers at once.

CISA, the Cybersecurity and Infrastructure Security Agency, added the bug to its Known Exploited Vulnerabilities catalog on Monday. That list is reserved for flaws where the agency has seen proof of active attacks, not just theoretical risk.

The move was first reported by The Hacker News.

What is Ray and why does this matter?

Ray is a Python-based framework, meaning a set of building blocks programmers use, that spreads AI and machine learning jobs across a cluster of machines. Training a large model on one laptop is slow. Ray lets a company throw dozens or hundreds of servers at the same job.

It is popular. The project has tens of thousands of stars on GitHub and is used inside major AI labs and cloud providers. If an attacker can break into a Ray cluster, they land on machines that often hold valuable model data, API keys, and access to cloud accounts.

How are attackers exploiting it?

Attackers are hitting Ray installations that are exposed to the internet without proper authentication, then running their own code on the servers. In plain terms: the criminals find a Ray dashboard sitting open online, send it a crafted request, and the server obligingly runs whatever they tell it to.

Researchers at Oligo Security previously documented a long-running campaign against exposed Ray clusters, which they named ShadowRay. That campaign has been used to steal cloud credentials and to install cryptocurrency mining software on victim machines. Attribution to a specific named group is thin. I would put the ShadowRay cluster at medium confidence as financially motivated, given the mining payloads, with no strong nation-state overlap reported so far.

Capability and intent are not the same thing here. The capability, remote code execution on AI infrastructure, would be attractive to espionage groups too. So far, the observed intent looks criminal.

Who needs to act?

Should ordinary people worry?

Not directly. This is an infrastructure bug, not a consumer product flaw. You will not be prompted to update anything on your phone.

The indirect risk is more interesting. Companies training AI models on Ray hold sensitive data, sometimes including customer records used as training input. A break-in at that layer could leak data that eventually reaches you as a phishing email or a leaked dataset.

If you work in IT at an organisation that uses Ray, the practical steps are simple. Update to the fixed release. Put the Ray dashboard behind a login and a private network. Assume any Ray instance that has been exposed to the open internet has already been probed.

CISA's catalog listing means federal agencies now have a hard deadline. For everyone else, the deadline is whenever the attackers get around to you.