This new integration combines multi-tenant GPU governance with runtime visibility at the accelerator layer, helping AI infrastructure operators enforce and demonstrate workload isolation. Now, AI operators can demonstrate that separation to auditors, regulators, and customers.
The NVIDIA Container Toolkit is mandatory, privileged, and almost entirely unmonitored — and most detection content written for it watches binaries that no longer execute. One docker run --gpus all produced six root executions of nvidia-cdi-hook on our test host, before the workload's first instruction. Here is what actually runs on a modern GPU node, and how Stealthium separates legitimate hook execution from abuse.
An internet-exposed Ray dashboard is an open door: an unauthenticated job submission runs attacker code on every node, and within minutes a crypto-miner is pinning your GPUs while your model weights walk out — all while monitoring reports a training job as running. We reproduced the ShadowRay 2.0 kill chain end to end against a real Ray cluster on an NVIDIA L40S and watched Stealthium catch every stage, from the unauthenticated request to the CUDA proof-of-work kernel.
Behind Bars (USENIX Security '26) found a side channel that survives NVIDIA MIG's L2 partitioning: GPU-wide memory barriers cross every partition on the card. We reproduced it independently on current H100 hardware, identified which of five LLMs a neighbor was serving from 0.558 seconds of trace at 97.0% accuracy, and caught the probe live with Stealthium.
As the demand and potential of AI scales exponentially, the infrastructure landscape is both fragmenting and flourishing. New neo-cloud providers and silicon providers are reestablishing a multi-cloud, multi-accelerator wave. This evolution of compute has not had a matching evolution of security.
Stealthium's runtime observability platform integrates with Tenstorrent's open AI compute platform to provide visibility into AI workloads running on Tenstorrent systems.
Januscape (CVE-2026-53359) is a shadow-MMU bug in KVM that lets a malicious guest fully escape to the host — on both Intel and AMD from the same trigger. It is invisible to every tool that watches only guests and host userspace. Here is how the attack unfolds, and how Stealthium stops its exploitation before impact.
An unprivileged process inside a CUDA container can gain arbitrary read/write to every byte of VRAM on a shared GPU — model theft, model poisoning, private inference data exposure. No special permissions, no kernel exploits, invisible to endpoint security. This is GPUBreach: Lateral Movement, Collection, and Impact.
Before the full GPUBreach paper was published, the Stealthium security team traced the vulnerable path in NVIDIA's open-source kernel modules, confirmed the overflow dimensions with an instrumented kernel build, and had detection in place. This post documents that analysis.
The US government has committed $500 billion to AI infrastructure. Enterprises are dropping eight figures on H100 clusters. And not one of them has a tool that tells them what is actually executing inside those accelerators at runtime.
When compiling a CUDA program, nvcc creates something more complex than a simple executable. This post explores the internals of CUDA's fatbin format — the multi-architecture binary container that makes 'compile once, run anywhere' possible, and the security implications hiding in plain sight.
NVML is the industry standard for GPU monitoring, but at production scale its per-call overhead compounds fast. Stealthium GPU Monitor is our answer: a monitoring layer we built and own, designed for deep observability with faster startup, lower memory footprint, and richer data than NVML in most cases.
Enterprises are deploying AI workloads with zero GPU-level security visibility, caught in a dangerous shared responsibility blind spot. Cloud providers secure the infrastructure—but what runs inside your GPU allocation has always been your responsibility.
As artificial intelligence infrastructure scales across enterprises and public sector organizations, security, transparency, and compliance have become critical operating requirements. Modern AI environments are highly distributed, GPU-accelerated, and often shared across multiple tenants, yet visibility and runtime protection at the GPU layer remain limited.
The AI revolution is happening whether you're on board or not, and that means something you're doing requires GPUs, probably something business critical. And when NVIDIA's kernel modules leaked two privilege-escalation vulnerabilities this fall, most organizations learned about GPU attack surfaces the hard way—through CVE notices rather than telemetry.