Tencent Releases AI-Infra-Guard, Open-Source Scanner for AI System Security
Tencent's Zhuque Lab has launched AI-Infra-Guard, an open-source security scanner designed to identify vulnerabilities and risks within artificial intelligence systems.
Tencent's Zhuque Lab has introduced AI-Infra-Guard, a new open-source security scanner specifically built to address the growing security concerns surrounding artificial intelligence systems. This tool aims to provide organizations with a comprehensive method for identifying potential risks and vulnerabilities inherent in their AI infrastructure.
The scanner offers robust capabilities, including the ability to fingerprint various AI services such as Ollama, vLLM, and ComfyUI. It then cross-references these services against a database of over 1,600 known Common Vulnerabilities and Exposures (CVEs). Beyond CVE matching, AI-Infra-Guard also inspects Model Context Protocol (MCP) servers and agent skills across 14 distinct risk categories. A key feature is its evaluation of AI models for jailbreaking vulnerabilities, utilizing the SkillTrustBench dataset for assessments.
AI-Infra-Guard's jailbreak evaluation process involves posing questions to a language model to determine if its responses appear malicious. These responses are then scored against SkillTrustBench, a public dataset containing 5,520 human-labeled samples across nine risk categories. The accuracy of these evaluations can vary, with false positive rates ranging from 1.20 percent to 18.67 percent, depending on the specific AI model used for judging.
The tool is already being adopted by several major organizations, including financial institutions like ICBC and China Merchants Bank, telecommunications provider China Telecom, and technology companies Lenovo and vivo, as well as the streaming platform Bilibili. This widespread adoption highlights the immediate need for specialized security tools in the rapidly evolving AI landscape.
AI-Infra-Guard is architected in two layers, with one layer focusing on interpretation. The development team emphasizes that CVE version-matching is not intent-based and its false positive rate is purely a function of fingerprint accuracy. The scanner is designed to ingest tool descriptions and skill files that could be controlled by a hostile server, specifically targeting indirect prompt injection techniques where malicious instructions are embedded within content the AI model processes.
To combat prompt injection, Release 4.1.9 of AI-Infra-Guard has implemented hardened scanning agents. These agents now process file and tool content within a dedicated, delimited text block in the prompt, structurally separated from instructions. The agent is explicitly instructed to treat this block as data for analysis, not as commands to execute. While this significantly mitigates naive to moderate injection attempts, the team cautions that it is a mitigation, not an absolute guarantee against all forms of attack.
Crucially, the open-source build of AI-Infra-Guard currently lacks an authentication mechanism, and the developers strongly advise against deploying it directly on the internet. The tool is designed as a single-operator utility, without login or Role-Based Access Control (RBAC). For organizations wishing to use it, the recommended approach is to place a reverse proxy in front of the application, such as Nginx with Basic Authentication or an IP allowlist, combined with standard firewall rules to control access.
AI-Infra-Guard is freely available on GitHub, offering a valuable resource for security professionals and organizations looking to bolster the security posture of their AI systems. The tool's open-source nature encourages community contribution and continuous improvement in addressing the unique security challenges posed by AI technologies.