Summary
SAPwned, disclosed by Wiz in 2024, is what cloud cross-tenant attacks look like in the AI era. SAP AI Core runs customers' machine-learning training jobs, and a training job is, fundamentally, someone else's code running on shared infrastructure. Researchers submitted a perfectly legitimate-looking training job and used it to escape the boundaries that were supposed to keep tenants apart, chaining several weaknesses until they had cluster-admin and could reach other customers' secrets, cloud credentials, and private AI models. It is the lesson that AI platforms inherit every hard cloud-isolation problem and add a new one: they are designed to run untrusted code.
How it happened
Wiz Research chained several weaknesses to break tenant isolation on SAP AI Core. They started by submitting a legitimate-looking training job (technically an Argo Workflow), which is exactly what the service is built to run. They configured the pod to read the Istio sidecar's token and bypass the network segmentation that was meant to fence tenants off from each other. That let them reach unauthenticated internal services: a Grafana Loki logging instance that was leaking AWS credentials, six unauthenticated AWS EFS file shares holding other customers' code and training data keyed by customer ID, and an exposed Helm 2 Tiller server.
The Helm server was the final lever. Using its write access, they deployed a malicious package that granted them cluster-admin, and with cluster-admin they had cross-tenant access to other customers' pods, secrets, and cloud credentials for AWS, Azure, and SAP HANA, plus a write-capable container-registry key that could have let them poison SAP's own Docker images and spread the attack further. SAP fixed all of the issues by May 2024 (after Wiz bypassed an initial patch with two more flaws) and stated that no customer data was compromised; the chain was found by researchers, not exploited in the wild.
The damage
SAPwned was a proof of concept rather than a real-world breach, but the potential was severe: any SAP AI Core customer could in principle have reached every other customer's training data, models, and cloud keys. Its real significance was in spotlighting AI and ML platforms as a fresh and rich cross-tenant attack surface, one that will only grow as more companies run their models on shared managed infrastructure.
Why SAPwned still matters
AI training platforms are uniquely exposed, because their entire job is to run customer-supplied code, the training job. That means the isolation between tenants has to be airtight, and here it was not: a training job became cluster-admin. It is essentially ChaosDB for the AI era, the same truth that cloud multi-tenancy is software that can fail, with the added twist that AI infrastructure runs untrusted code by design. The defences: enforce strong tenant isolation and network segmentation so a tenant pod cannot reach internal services, lock down service tokens, internal logging, shares, and Helm behind authentication and least privilege, treat training-job inputs as untrusted and sandbox the workloads, restrict cluster RBAC, and rotate any exposed credentials. As AI platforms proliferate, this class of flaw will keep recurring.
How to fix it
- Apply the provider's fixes and rotate any cloud credentials the isolation break could have exposed.
- Lock down internal services (logging, shares, Helm) behind authentication and least privilege so a tenant pod cannot reach them.
- Audit cross-tenant access paths and restrict cluster RBAC so a training job cannot escalate to cluster-admin.
How to avoid it
- Apply SAP's fixes (patched by May 2024) and keep AI Core platform components updated.
- Enforce strong tenant isolation and network segmentation; block pods from reaching internal services.
- Lock down service tokens, internal logging, shares, and Helm with authentication and least privilege.
- Treat training-job inputs as untrusted; sandbox workloads and restrict cluster RBAC.
- Rotate exposed cloud credentials and audit cross-tenant access paths.
References
Related vulnerabilities
All AI/LLM →- HIGHAI-CLAUDECODE-SOURCEMAP-2026
On March 31, 2026, Anthropic accidentally shipped the full source of its Claude Code CLI inside a published npm package. A missing .npmignore rule for *.map left a roughly 59.8 MB source map in the tarball, embedding about 512,000 lines of unobfuscated TypeScript across some 1,900 files, including internal prompts, tool definitions and architecture. The root cause was a packaging failure compounded by a bundler bug: Bun continued emitting source maps even when generation was disabled, and nothing stripped or excluded them before publish. Because npm releases are immutable and mirrored instantly, the source was cloned, dissected and re-hosted within hours, and a clean-room reimplementation reached tens of thousands of GitHub stars the same day. It is a textbook source-map disclosure: the sourcesContent field of a .map file carries the original code verbatim, so a single map left in a shipped artifact hands an attacker the entire codebase, comments and all. The same class hit Apple's App Store web front-end in November 2025, where production source maps left enabled let a researcher reconstruct and publish the full client source.
- CRITICALAI-COPILOT-CAMOLEAK-2025
Legit Security disclosed CamoLeak (CVSS 9.6), a critical vulnerability in GitHub Copilot Chat enabling silent exfiltration of private source code and secrets. The attack combined remote prompt injection via hidden pull-request comments with a CSP bypass that abused GitHub's own Camo image proxy: injected instructions made Copilot extract sensitive repo context, encode it character-by-character into a pre-generated dictionary of Camo image URLs, and leak it through image requests to an attacker server. GitHub mitigated it by disabling image rendering in Copilot Chat in August 2025.
- HIGHAI-SHADOWLEAK-2025
ShadowLeak is a server-side zero-click indirect prompt-injection attack against ChatGPT's Deep Research agent, discovered by Radware. An attacker emails the victim a message with instructions hidden in the HTML using white-on-white text and tiny fonts; when the user runs Deep Research over their inbox, the agent autonomously follows the hidden instructions and exfiltrates personal and inbox data. The distinguishing trait is that exfiltration occurs entirely server-side within OpenAI's cloud infrastructure, making it invisible to local and enterprise network defenses. The Gmail proof of concept generalizes to any Deep Research connector; OpenAI fixed it before public disclosure with no evidence of in-the-wild exploitation.
- CRITICALAI-TEA-APP-BREACH-2025
Tea was a women's safety app, a place to share warnings about men, which meant it held some of the most sensitive data imaginable: selfies, government IDs, and private messages. In July 2025, just as it hit number one on the US App Store, it turned out that one of its storage buckets was simply open to the internet, no password, directory listing on. Roughly 72,000 images, including 13,000 verification selfies and photo IDs, plus over a million private messages, were exposed and promptly dumped on 4chan, fueling doxxing of the very women the app was meant to protect. Often called a "vibe-coding" disaster, it was actually something older and just as instructive: an app built by outsourced contractors for a founder who could not read the code, with no security review, shipping a misconfigured cloud bucket and a broken-access-control flaw nobody caught.
- MEDIUMAI-GEMINI-WORKSPACE-2025
Marco Figueroa of Mozilla's 0DIN program documented a Gemini for Workspace flaw where an attacker hides instructions inside an email using tags styled with font-size zero or white-on-white text, invisible to the recipient. When the user clicks Summarize this email, Gemini processes the raw HTML and treats the hidden directive as a high-priority instruction, appending an attacker-crafted fake security warning, such as a fake support phone number, that appears to come from Google. No links or attachments are required, enabling credential harvesting and vishing at scale through indirect prompt injection.
- HIGHAI-AGENTSMITH-2025
Noma Security discovered AgentSmith, a flaw in the public LangSmith Prompt Hub where an attacker uploads a malicious AI agent with a pre-configured proxy server baked into its settings. When a victim adopts and runs the shared agent, all traffic including OpenAI API keys, prompts, uploaded documents, images and voice inputs is silently routed through the attacker's proxy, enabling exfiltration of API keys, theft of data and man-in-the-middle manipulation of downstream LLM responses. LangChain confirmed and fixed the issue in November 2024; scope was limited to the public Prompt Hub sharing feature and there was no evidence of in-the-wild exploitation.