On August 17, 2026, CVE-2026-64849, a critical vulnerability in the open-source AI engineering platform MLflow, was publicly disclosed with a CVSS score of 9.3. Just two days later, on August 19, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added it to its Known Exploited Vulnerabilities (KEV) catalog. This is an unauthenticated server-side request forgery (SSRF) vulnerability: attackers can abuse the Webhook mechanism in MLflow's model registry to force the server to send requests to cloud metadata endpoints, thereby stealing temporary access credentials for AWS and other cloud platforms. Within hours of the CVE being assigned, large-scale scanning of exposed MLflow instances appeared across the internet. When the AI platform itself becomes a directly exploitable attack surface, the boundary of cloud workload protection is being redrawn—and AIStorm CloudGuard, with its cross-cloud unified CWPP capabilities, helps enterprises systematically reduce credential exposure risk in cloud-native environments.

MLflow is not an isolated case. Around the same time, Beacon, a UK-based CRM provider for charities, disclosed that an AWS access key accidentally embedded in a public JavaScript build artifact had been used by attackers to copy and exfiltrate its entire customer database, affecting donor information from more than 1,000 UK charities. In the broader AI and machine-learning ecosystem, security firm Truffle Security scanned public datasets on the model platform Hugging Face—7.6 petabytes and 187 million files in total—and found 221,303 still-valid unique credentials, including thousands of cloud service account keys, making AI/ML platforms the single largest source of leaked cloud credentials. These three incidents echo one another and point to a shared conclusion: cloud credential leakage is no longer an occasional configuration oversight, but a systemic risk amid the deep convergence of cloud-native and artificial intelligence.

To understand the damage of such attacks, one must first reconstruct the full kill chain. Take MLflow SSRF as an example: the attacker does not need to breach the cloud perimeter directly. Instead, they reach a cloud-native application that is legitimately accessible, then use it as an "insider" to request temporary credentials from the cloud instance's metadata service. Once obtained, they impersonate this legitimate identity to access cloud resources and, leveraging over-granted permissions, move laterally across multi-cloud environments, ultimately completing data theft. The reason this chain—"exposed application → SSRF springboard → metadata key retrieval → credential impersonation → cross-cloud spread"—succeeds so often is that traditional point defenses can only see fragmented network requests or host behavior in isolation. They can neither grasp the true exposure of cloud-native assets nor connect application vulnerabilities, credential permissions, and cross-cloud actions into a single analyzable trajectory.

This is the crux of the proposition that "the AI platform is the attack surface." As enterprises migrate AI workloads such as MLflow, large-model training nodes, and inference services to the cloud at scale, these systems often combine network reachability, tool-calling capability, and cloud-resource access permissions in one place. A single unpatched vulnerability or hardcoded credential can become the shortest path for attackers into the cloud environment. Against this shift, simply stacking rules at the network perimeter or running antivirus on individual hosts is no longer sufficient. What enterprises truly need is a workload-centric, systematic defense that simultaneously covers assets, configuration, permissions, and behavior.

As the cloud workload protection platform of AIStorm, the global brand of AsiaInfo Security, AIStorm CloudGuard is built on the product philosophy of "One CWPP. Every Cloud." and fully covers the three workload protection models of CWPP. Addressing the primary challenge of "invisible cloud-native assets," it automatically discovers all workloads—physical machines, virtual machines, containers, and Serverless instances—and, relying on more than 5,000 asset-identification rules, draws a dynamic asset topology. This leaves AI/ML platforms directly exposed to the public internet, instances carrying sensitive credentials, and shadow assets outside management with nowhere to hide, providing a clear and accurate asset baseline for subsequent risk reduction.

Building on a clear inventory, AIStorm's CloudGuard further compresses the attack space from two dimensions: configuration baselines and permission reduction. On one hand, it continuously performs baseline compliance checks on cloud hosts and cloud-native workloads, promptly identifying misconfigurations, unsafe metadata access policies, and other hidden risks. On the other hand, through host-account security protection and least-privilege control, it constrains the actual usable scope of instance roles and access credentials, preventing a single leaked key from sweeping an entire cloud account. Even if an attacker obtains temporary credentials, the over-authorized channels have already been narrowed in advance, significantly limiting the "blast radius" of cross-cloud lateral movement.

Against the critical springboard of SSRF reaching the cloud metadata service, AIStorm CloudGuard builds defense-in-depth coordination with ThreatShield, another product in the AIStorm portfolio. CloudGuard leverages more than 50,000 vulnerability rules and virtual-patching technology to intercept exploitation attempts at the application-traffic layer, buying valuable remediation windows for systems such as MLflow that have not yet been upgraded—without requiring business restarts. ThreatShield, drawing on tens of millions of threat intelligence entries, blocks anomalous outbound requests, SSRF probes, and illegal access to metadata addresses at the network layer. Its multi-layer detection engines also cover more than 3,000 file formats and dozens of ransomware and trojan families, containing vulnerability exploitation, credential theft, and subsequent implant actions within a single closed loop.

Notably, multi-cloud environments often act as amplifiers of credential risk, with siloed policies across different cloud platforms easily leaving management gaps. AIStorm CloudGuard can uniformly manage heterogeneous environments such as VMware, OpenStack, and KVM, keeping security policies, asset views, and risk handling consistent across hybrid clouds. Its lightweight, converged Agent integrates firewall, intrusion prevention, file protection, and process protection into a single suite, with peak CPU usage controlled within 5%, avoiding the additional performance burden that multi-Agent stacking would impose on high-load workloads such as AI training.

From MLflow's urgent addition to the KEV catalog, to Beacon's entire database being exfiltrated over a single key, to hundreds of thousands of still-valid credentials on Hugging Face, the security logic of the cloud-native era is clear: credentials are becoming the new security boundary, while AI workloads are the entry point attackers covet most. The value of a Cloud Workload Protection Platform (CWPP) lies in re-converging previously scattered assets, configuration, permissions, and behavior into a unified, visible, and controllable whole. With one platform spanning every cloud, AIStorm CloudGuard helps enterprises reap the efficiency dividends of AI while systematically blocking the credential-theft chain—from SSRF to metadata, and on to cross-cloud lateral movement—laying a solid security foundation for the stable operation of cloud-native and AI businesses.

At AIStorm, cyber resilience is not built through isolated security products. It is achieved through a continuous security cycle of visibility, protection, detection and improvement.

Find 

The first step is knowing what is exposed.

Using External Attack Surface Management (EASM), organisations can continuously discover internet-facing assets, identify shadow IT, uncover forgotten services, and understand where external risks exist before attackers exploit them.

Block 

Once exposure is identified, risks should be reduced as quickly as possible.

Virtual patching provides immediate protection for vulnerable and legacy systems without waiting for maintenance windows, software upgrades or application changes—helping organisations minimise risk while maintaining business continuity.

Monitor 

Cyber threats evolve continuously.

Network Detection & Response (NDR), combined with Threat Intelligence, enables organisations to monitor network activity, detect suspicious behaviour, identify emerging threats, and uncover attacker activity before incidents escalate.

Remediate 

Security does not end after detection.

The final step is closing the loop—prioritising remediation, reducing measurable risk, and continuously strengthening operational resilience as the threat landscape evolves.

This is an Exposure-to-Response approach: transforming cybersecurity from periodic assessments into a continuous security lifecycle.