# AI Data Centers Are Being Built Faster Than They Can Be Secured—And It's Creating a Security Time Bomb
The explosive growth in artificial intelligence infrastructure has triggered a race to build data centers capable of powering increasingly demanding AI models. But security researchers warn that this breakneck pace of construction is leaving a dangerous gap: the architects and operators of these facilities often lack the foundational security practices that have been refined over decades in traditional data centers. The result is a new class of infrastructure vulnerable to attacks that could compromise not just individual customers, but entire AI compute ecosystems.
According to a new report from infrastructure security firm Lava Labs, AI data centers are being built faster than they are being secured—and the difference between traditional data center security and AI infrastructure security is far more profound than many organizations realize. The problem isn't simply that some boxes are checked slower than others; it's that the fundamental architecture, trust models, and operational realities of AI infrastructure are fundamentally different from the computing facilities that preceded them.
## The Fundamental Difference: Traditional vs. AI Data Centers
To understand the urgency of this security crisis, it's essential to recognize what makes AI data centers fundamentally different from their predecessors.
Traditional data centers are primarily designed as data processing warehouses serving known, trusted clientele. They typically comprise a series of independent or loosely coupled servers, each relatively isolated from the others.
AI data centers, by contrast, are more akin to high-power compute factories serving a larger and often unknown customer base. They must function as integrated systems capable of massive parallel processing, with hundreds or thousands of GPUs working in concert to train and run AI models. A single AI model training run might consume the resources of an entire facility for weeks or months.
This architectural shift changes everything about the security model. "Systems originally designed for trusted operators are now supporting high-value, multi-tenant workloads from unrelated customers," notes the Lava Labs report. In other words, an AI data center might simultaneously be running proprietary models for a pharmaceutical company, a financial services firm, and a technology giant—all sharing the same physical infrastructure, power systems, and network fabrics.
## The Lava Labs Framework: 10 Critical Risks Called "Forge"
Lava Labs has identified and ranked the top ten security risks facing modern AI infrastructure under a framework they call "Forge"—a reference to hardening the metal beneath the model. Critically, these risks are not ranked alphabetically or by industry convention; they are sequenced strictly by severity and blast radius.
### Highest-Severity Risks (Risks 01–05)
These five risks operate below the operating system level, are extremely difficult to detect, and carry cluster-wide blast radius implications:
| Risk | Category | Threat |
|------|----------|--------|
| Forge 01 | Firmware & Hardware | Compromise of firmware or hardware integrity at the foundational level |
| Forge 02 | Network & Interconnect | Vulnerabilities in high-performance fabrics (InfiniBand, RoCE, RDMA, NVLink) |
| Forge 03 | Multi-Tenant Isolation | Unsafe isolation between customers; unauthorized resource reuse |
| Forge 04 | Out-of-Band Management | Insecure administrative access through BMC, Redfish, IPMI protocols |
| Forge 05 | Supply Chain | Compromise of AI infrastructure components before deployment |
### Medium-Severity Risks (Risks 06–09)
These risks are somewhat easier to detect and recover from:
### Lower-Severity Risk (Risk 10)
## Technical Details: Why AI Infrastructure Breaks Traditional Security
The specifics of why AI data centers require entirely new security approaches reveal the depth of the challenge:
### High-Performance Interconnects Are Largely Unencrypted
The network fabrics that connect AI accelerators—InfiniBand, RoCE (RDMA over Converged Ethernet), NVLink, and others—are often deployed with minimal encryption and monitoring. These high-speed interconnects are rarely designed with multi-tenant security in mind. Weak fabric isolation creates pathways for lateral movement, discovery attacks, or workload interference.
### GPU Reassignment Introduces Cross-Tenant Risks
Unlike traditional cloud environments where compute instances are cleanly isolated, GPUs in AI data centers are frequently reassigned between customers, sometimes within hours. Incomplete memory wiping, cache poisoning, or side-channel attacks leveraging GPU microarchitectural vulnerabilities could allow one customer to extract proprietary information from another's workloads.
### Dense Cluster Architectures Amplify Blast Radius
Traditional data centers could tolerate failures in individual racks or even entire sections. AI data center clusters require thousands of GPUs working in synchronized parallel. A single firmware compromise, a misconfigured switch, or a physical security breach affecting the wrong cabinet could cascade across an entire facility, compromising all active training jobs simultaneously.
### Thermal and Power Complexity Creates New Attack Surfaces
GPU clusters generate extreme heat and demand unprecedented power densities. This requires complex firmware stacks, dynamic power management, and facility automation systems. Each layer introduces potential security flaws—and facility management systems (HVAC, power distribution) are rarely hardened to the standards expected of IT infrastructure.
### Supply Chain Vulnerabilities in GPU Sourcing
GPU scarcity has driven some data center operators to source processors that are less suitable for their intended purpose or that lack robust isolation features. This creates incentives to accept hardware with weaker security properties to meet capacity demands.
## The Operational Concentration Problem
Many AI data centers rely heavily on infrastructure automation: Baseboard Management Controllers (BMC), Redfish, IPMI, and container orchestration systems. This concentration of privilege—especially when automation pipelines lack proper access controls—creates a single point of failure. A compromise of the orchestration layer could give an attacker control over the entire facility.
## Implications: Who's at Risk?
The risks identified by Lava Labs have direct implications for multiple stakeholders:
## Recommendations for Defense
Organizations building or operating AI infrastructure should:
1. Implement strict firmware verification and secure boot mechanisms before accepting any hardware into the facility
2. Encrypt traffic on internal data center fabrics even where performance impacts exist; the security benefit justifies modest latency trade-offs
3. Require complete GPU memory erasure between customer assignments, with cryptographic verification
4. Segregate out-of-band management networks completely from tenant-accessible networks, with hardware-enforced isolation
5. Conduct quarterly third-party security audits of data center management systems and supply chain processes
6. Demand transparency from vendors regarding patching velocity and the timeline for security fixes
7. Implement continuous monitoring for cross-tenant interference, unusual memory access patterns, and network anomalies
8. Establish incident response procedures that account for cluster-wide compromise scenarios, not just individual machine failures
---
## HackWire Analysis
The Lava Labs report arrives at a critical moment: AI infrastructure is doubling globally every 12–18 months, driven by competition to train larger and more capable models. Yet the security maturity of this infrastructure is still measured in months, not years. This is not a case of organizations being negligent—it's a case of unprecedented technical demands simply outpacing institutional knowledge.
What's particularly concerning is that the highest-severity risks (Forge 01–05) operate at layers where traditional endpoint detection and response solutions are completely blind. A firmware compromise in an AI data center is orders of magnitude harder to detect than a compromised server in a traditional cloud environment. And because thousands of GPU nodes depend on synchronized communication through shared network fabrics, a single exploitation point can cascade into facility-wide compromise.
The timing is critical because AI data center operators are currently making architectural decisions—about network design, hardware choices, automation systems, and management practices—that will define the security posture of these facilities for the next five to seven years. Those decisions are being made under intense pressure to achieve capacity targets. The security architecture is being retrofitted after the fact, not baked in from the beginning.
The most dangerous blind spot may be supply chain risk. As GPU scarcity drives procurement of marginal hardware or previously untested components, the attack surface expands in directions that the security community hasn't fully assessed. A compromised firmware image in a batch of accelerators destined for a major AI facility could remain dormant until activated, giving attackers persistent, hardware-level access.
Organizations using third-party AI compute providers must now add a new category of due diligence to their risk assessment: not just "is this cloud secure?" but "does this AI facility operator understand the specific threat model they're operating in?" Asking about Forge risks should become part of standard vendor security questionnaires.
— HackWire Editorial
---
## Related Coverage