Tools with no login required out of the box: 10 of 14 (Source: Sorami Consulting technical report (September 24, 2026))
Fifteen charts, one shared assumption
When an organization deploys self-hosted AI on Kubernetes — a model server, a gateway in front of it, a vector database for retrieval, or a tool that can act on the cluster itself — the installation path is almost always the same: the vendor's own Helm chart, taken as published. Sorami Consulting rendered and statically analysed 15 such charts, covering serving tools like vLLM and KServe, gateways like Open WebUI and LiteLLM, vector databases including Qdrant, Weaviate and Milvus, and Kubernetes MCP servers, using each chart's own values.yaml with no manual hardening. Eight of the 15 could be started in a local test cluster and were also probed live. The firm's threat model assumes an attacker who already holds a foothold on a single pod — through a compromised web app, a malicious dependency in a CI pipeline, or a shared-tenant workload — rather than an outsider scanning the open internet.
What a compromised pod can already reach
The finding that should reach a budget-holder is less about any single product and more about the combination of defaults. Ten of 14 tools with an API omitted native authentication by default, on the assumption that the network around them is trusted. Every one of the six omitted-auth tools that Sorami actually ran answered unauthenticated requests. Separately, 10 of 15 charts did not enforce non-root execution for their containers, and seven charts combined both gaps at once. None of this required exploiting a flaw in the software — it is what happens when a chart is installed exactly as the vendor ships it.
Two concrete failures behind the aggregate numbers
Sorami named specific outcomes rather than only percentages. One Kubernetes MCP server, queried without credentials, listed 23 available tools and returned Secret names from namespaces outside its own — information an agent-facing tool should not hand to an anonymous caller. Separately, in LiteLLM's chart, a database migration Job runs with credentials embedded as plain-text environment variables, readable by anything with visibility into that pod's spec. Those two cases are not representative of the full set: only 4 of the 15 charts examined bind a ClusterRole capable of reading Secrets, which is what let a compromised pod's reach extend past its own namespace in the first place.
Not the first warning about open AI infrastructure
Sorami's report follows two earlier looks at the same problem from outside the cluster. Oligo's researchers documented the ShadowRay incident: thousands of internet-facing Ray clusters were compromised through the Jobs API, which ships without authentication by default. NVD tracks the underlying issue as CVE-2023-48022, marked disputed because the vendor treats the behavior as an intended default rather than a flaw. Separate internet scans by Wiz and Cisco each found more than 1,000 exposed Ollama servers, in 2024 and 2025 respectively. Those two studies measured exposure visible from the public internet. Sorami's contribution is to show that the same open-by-default posture exists one step earlier, at the chart's own configuration — reachable by anyone who already has a foothold inside the cluster, whether through a compromised web application, a malicious dependency executed in a CI pipeline, or a shared-tenant workload.
Questions for the platform team
A budget-holder overseeing infrastructure spend should ask three things directly. First, which AI-related Helm charts — model servers, gateways, vector databases, MCP tools — are running in production with default values, and has authentication been explicitly turned on for each. Second, whether NetworkPolicies restrict traffic between AI workloads and the rest of the cluster, given that 14 of 15 charts tested ship none by default. Third, whether any ServiceAccount tied to AI tooling holds a ClusterRole that can read Secrets outside its own namespace, and whether that scope has been reviewed since installation rather than left at the vendor's out-of-the-box setting.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: sorami.com.au.
