Lava Security and OWASP Highlight Why AI Infrastructure Security Must Start Below the Operating System

Imagine renting a powerful server to run an artificial intelligence workload, reinstalling its operating system, and assuming the machine is ready for another customer. Yet a hardware configuration modified during the previous deployment remains untouched. The next tenant could unknowingly inherit an environment that has already been compromised.

This is one of the scenarios examined by Lava Security in its new Top 10 Neocloud and AI Data Center Security Risks framework, which has become an official OWASP project.

The example illustrates a less visible dimension of AI security. While organizations invest in protecting applications, models, and data, the infrastructure supporting those workloads introduces another set of vulnerabilities. In particular, shared GPU environments can create risks involving hardware configurations, firmware, management interfaces, and the separation between customers.

Developed by Yakir Kadkoda, CTO and Co-Founder of Lava Security, and Michael Katchinskiy, Head of Security Research, the framework aims to give infrastructure providers and users a common reference for identifying and addressing these threats.

When an Operating System Reinstall Is Not Enough

Bare-metal neocloud environments can give customers root access to rented servers. This level of control is useful for organizations that need direct access to their computing resources, but it also introduces security considerations that extend beyond the operating system.

Unrestricted access to management interfaces could allow a tenant to modify hardware boot configurations. Because those settings may survive an operating system reinstall, the changes could remain in place when a server is returned to the provider.

If the provider does not reset those configurations before assigning the hardware to another customer, the next tenant could inherit a compromised environment.

The scenario highlights the importance of securing management interfaces and understanding what happens beneath the software layer.

“AI infrastructure introduces attack surfaces that traditional security approaches may not adequately address. Organizations need to understand what happens below the operating system, particularly when hardware, firmware, and management interfaces are shared across customers,” said Michael Katchinskiy, Head of Security Research at Lava Security. “This framework helps make those risks easier to identify and provides practical guidance for addressing them.”

The Technology Behind the Risk

The infrastructure supporting modern AI workloads is considerably more complex than a conventional server deployment. AI data centers combine thousands of GPUs, high-speed networking, specialized management controllers, shared storage, and complex orchestration systems.

Many of these technologies were originally designed for trusted high-performance computing environments. Their increasing use in commercial neocloud environments, where unrelated organizations share physical infrastructure, changes the security considerations.

Lava Security’s framework examines vulnerabilities across the hardware, firmware, networking, management, and operational layers.

Its scope includes compromised server firmware, weaknesses in InfiniBand and RDMA networking technologies, inadequate tenant isolation, and insecure out-of-band management interfaces.

It also addresses supply chain threats, data center facility systems, shared storage and AI artifacts, incomplete security certifications, centralized operational services, and delays in vulnerability patching.

Each category includes potential attack scenarios, real-world implications, and practical mitigation recommendations. This allows providers and operators to evaluate their environments while giving organizations purchasing GPU cloud capacity a reference for understanding the controls protecting their workloads.

From an Individual Research Effort to an OWASP Project

The framework was initially published in July 2026, based on disclosed vulnerabilities, incident reports, technical documentation, and Lava Security’s research into AI infrastructure security.

Its development also incorporated feedback from more than 20 practitioners representing neocloud providers, hardware OEMs, security companies, universities, and research institutions.

Becoming an OWASP project provides an opportunity to expand that participation and make the framework a continuing community effort.

“Securing AI infrastructure requires looking at the entire environment, not just individual components. Hardware, networking, management systems, and workloads are interconnected, and risks in one area can affect the security of the broader infrastructure,” said Yakir Kadkoda, CTO and Co-Founder of Lava Security. “Developing this framework within OWASP gives the community an opportunity to contribute its expertise and continuously improve how these risks are understood and addressed.”

What Comes Next

The initiative will continue evolving through an open development process on GitHub. Security researchers, infrastructure engineers, hardware vendors, and operators can review its contents, challenge existing assumptions, propose changes, and contribute additional research or mitigation recommendations.

Contributors will be credited in future releases. The project is intended to evolve alongside changes in AI infrastructure, including new GPU architectures, networking technologies, management systems, and deployment models. Those interested in the initiative can visit the official OWASP project page or access the GitHub repository to participate.

As AI computing environments become more interconnected, security assessments that stop at the operating system may leave important questions unanswered. Lava Security’s framework puts those underlying infrastructure risks into a shared industry discussion.