Tencent releases AI-Infra-Guard security scanner for AI systems

Tencent scanner targets AI infrastructure vulnerabilities

Tencent's Zhuque Lab has released AI-Infra-Guard, an open-source security scanner designed to identify vulnerabilities in AI systems and evaluate agent skills for malicious behavior. The tool addresses a growing need as organizations deploy AI services including Ollama, vLLM, and ComfyUI across their infrastructure.

The scanner operates on two distinct layers. First, it fingerprints running AI services and cross-references them against a database of more than 1,600 known CVEs. This component relies on version matching rather than interpretation, making its accuracy dependent on fingerprint precision.

The second layer uses language models to evaluate MCP servers and agent skills across 14 risk categories. Zhuque Lab benchmarked this capability against SkillTrustBench, a dataset containing 5,520 human-labeled samples spanning nine risk categories. False positive rates vary significantly based on which language model performs the analysis—ranging from 1.20 percent to 18.67 percent.

Real-world deployment and accuracy trade-offs

The variance in false positives creates practical challenges for security teams. At the lower end, approximately one in 80 legitimate skills triggers an alert. At the higher end, nearly one in five flags requires investigation of a benign capability. Organizations including ICBC, China Merchants Bank, China Telecom, Lenovo, vivo, and Bilibili have deployed the tool despite these accuracy limitations.

The scanner must process files and tool descriptions that potentially hostile servers control, creating an inherent security risk. Release 4.1.9 introduced hardening against indirect prompt injection attacks—where instructions embedded in content attempt to manipulate the scanning model itself.

According to the AI-Infra-Guard team, the platform now places file and tool content into explicitly delimited text blocks within prompts, structurally separated from instructions. The team characterizes this as a mitigation rather than a complete defense, noting they would not claim any LLM-driven agent is unbreakable. Security teams should treat clean scan results as one data point rather than definitive clearance.

Deployment requires external access controls

The open-source release lacks built-in authentication, creating a significant deployment consideration. The repository includes explicit warnings against internet exposure without additional safeguards. Zhuque Lab designed AI-Infra-Guard as a single-operator tool without login functionality or role-based access control.

The recommended deployment architecture places a reverse proxy with Basic Auth or IP allowlisting in front of the scanner, combined with standard firewall rules. This external layer becomes critical because the scanner holds API keys for every model it evaluates. Without proper access controls, organizations risk exposing a vulnerability assessment tool that contains credentials for their AI infrastructure.

Why it matters

As organizations rapidly deploy AI agents and services, security tooling has lagged behind. AI-Infra-Guard represents an early attempt to systematically scan AI infrastructure for both traditional software vulnerabilities and AI-specific risks like malicious agent skills. The tool's adoption by major financial institutions and telecommunications providers signals enterprise demand for AI security capabilities, even with accuracy limitations and deployment complexity. The false positive rates and authentication requirements highlight how AI security tooling remains immature compared to traditional application security scanners.

AI-Infra-Guard is available on GitHub. Details were first reported by Help Net Security.