# The risk in malicious AI models: Wiz Research discovers critical vulnerability in AI-as-a-Service provider, Replicate

Malicious Cog model gave root RCE in a Replicate pod; TCP injection into a neighbor's authenticated Redis session enabled cross-tenant prompt/response theft and tampering.

- Payout: Research
- Severity: critical
- Program: Replicate
- Credited: Wiz Research
- Disclosed: 2024-05-23
- Write-up quality: 9/10
- Original: https://www.wiz.io/blog/wiz-research-discovers-critical-vulnerability-in-replicate
- Library page: https://bugbountylibrary.com/r/blog%3Awiz-io-blog-wiz-research-discovers-critical-vulnerability-in-replicate
- Tags: domain:ai domain:cloud impact:data-leak impact:integrity kind:research platform:threat-intel sev:critical tech:kubernetes tech:redis technique:chained technique:recon vuln:misconfiguration vuln:rce

**Target:** AI-as-a-service inference platform (Cog containers, Kubernetes pod, Redis Streams queue)
**Root cause:** Cog model containers allow arbitrary code execution, and the inference pod shares a network namespace with a Redis client container holding a pre-authenticated plaintext connection to a centralized multi-tenant Redis queue.
**Steps:**
1. Build a malicious Cog container that executes code on startup and upload it to Replicate.
2. Interact with the model via Replicate UI/API to get RCE as root inside the pod.
3. Run `netstat` to spot an established TCP connection owned by a process in another PID namespace (shared netns).
4. Use `tcpdump` (CAP_NET_RAW/CAP_NET_ADMIN) to confirm the stream is plaintext Redis protocol; reverse DNS confirms Redis.
5. Attempt `redis-cli` connection fails (auth required, no creds in pod).
6. Use `rshijack` to inject packets into the existing authenticated TCP connection, bypassing auth.
7. Inject `INFO` to confirm multi-tenant queue; inject a Lua script that pops the target item, rewrites its `webhook` field to an attacker server, and pushes it back.
8. Host rogue API server on internet, tunnel to worker pod; receive prediction input and output, and modify output.
**How found:** Hypothesis that AI models are code and AI-as-a-service providers have tenant isolation gaps; uploaded a malicious Cog container to test RCE, then during post-exploitation recon noticed an established TCP connection to a process in a different PID namespace, deduced shared network namespace, sniffed plaintext Redis, and reasoned the queue likely served multiple customers.
**Exploitation:** Attacker uploads a malicious Cog model, gains root RCE in their pod, sniffs the shared network namespace to find a plaintext authenticated Redis connection from a neighboring container, then uses rshijack TCP injection to run a Lua script against the centralized multi-tenant Redis Streams queue, redirecting another customer's prediction webhook to an attacker-controlled server to capture prompts/results and alter outputs.
**Escalation:** Pivoted from single-tenant container RCE to cross-tenant data access and integrity impact by abusing shared pod network namespace and an already-authenticated Redis session, without needing Redis credentials.
**Insight:** After RCE in a Kubernetes pod, check `netstat` for established connections owned by other PID namespaces: shared netns plus CAP_NET_RAW lets you hijack a neighbor's already-authenticated plaintext session (e.g. Redis) with rshijack instead of stealing credentials.