Open source AI has grown into a sprawling ecosystem where a single product might pull code from dozens of repositories,

Open-source AI has grown into a sprawling ecosystem where a single product might pull code from dozens of repositories, rely on training data from multiple sources, and run on specialized hardware configurations that few teams fully document. Keeping track of these dependencies is hard. Understanding which parts of that stack are exposed to the internet is harder. Current AI's release of the Open Source AI Gap Map v0.1 attempts to bring some order to that chaos, and security teams should treat it as required reading.

The index catalogs 421 open-source AI products. It breaks them down into four categories: AI models, datasets, software tools, and hardware. Under the hood, the entire project runs on 1,184 YAML files that track more than 16,000 GitHub repositories. That gap between 421 products and 16,000 repositories tells its own story. Most AI applications are not self-contained monoliths. They are assemblies of inference engines, fine-tuning scripts, data loaders, evaluation benchmarks, and driver layers, each living in its own repository with its own maintainers, commit histories, and vulnerability profiles.

Current AI published the dataset under an MIT license and made it fully public. That openness is the point. Anyone can download it, parse the YAML, and build tooling on top of it. For defenders, that accessibility is an opportunity. For attackers, it is equally convenient.

What the Map Actually Tracks

Most organizations using AI do not have a clear inventory of what they have deployed. A team might download a language model from a popular hub, install a few Python packages to run it, and call the job done. But underneath that simple workflow sits a nested set of dependencies. The model weights come from one repository. The tokenizer configuration comes from another. The inference framework might be a fork of a third project. The CUDA drivers and container images pull from yet more sources.

The Gap Map captures this by organizing its 1,184 YAML files around 421 distinct AI products. The over 16,000 GitHub repositories mapped here represent the actual code, configurations, and artifacts that make those products function. By separating entries into models, datasets, software tools, and hardware, the index forces a basic question: do you know which of these four layers your systems actually touch?

If you are running an open-source large language model in production, you are likely touching all four. You depend on the model weights and architecture. You depend on the datasets used for pre-training or fine-tuning, even if you never downloaded them directly. You depend on software tools to convert, quantize, or serve the model. And if you are running on GPUs or specialized accelerators, you depend on firmware and driver stacks that fall under the hardware category.

The Security Double-Edged Sword

This dataset serves two masters, and security leaders need to understand both sides.

On the defensive side, the Gap Map functions like a phone book for your AI supply chain. You can compare the repositories and tools your organization depends on against this index and spot gaps in your visibility. If a critical repository appears in the map but not in your software bill of materials, you have likely found shadow AI infrastructure. That is worth knowing before an adversary finds it for you.

On the offensive side, the dataset is reconnaissance gold. Attackers constantly scan for exposed AI infrastructure, model serving endpoints, and vulnerable dependencies in popular ML pipelines. The Gap Map gives them a machine-readable, structured list of targets organized by exactly the categories they care about. A single YAML parser can extract thousands of repository URLs, and from there an attacker can cross-reference known vulnerabilities, look for misconfigured public instances, or identify high-value targets for dependency confusion attacks.

Because the data is MIT-licensed and public, there is no barrier to entry. No subscription, no approval process. That design choice maximizes utility for researchers and defenders, but it also maximizes utility for threat actors. The same file that helps you harden your stack helps someone else build a target list.

What to Do With This Information

Treat this dataset exactly as you would treat a threat intelligence feed. Do not bookmark it and forget it. Run an active check against your environment.

התחילו בשליפת רשימה של כל רכיב AI בקוד פתוח שהצוותים שלכם משתמשים בו כיום. חפשו מעבר לברור מאליו. שאלו אילו מאגרים (repositories) מספקים את ה-tokenizers שלכם, את סקריפטי ההערכה (evaluation scripts), את ספריות ה-quantization ואת תמונות הבסיס של הקונטיינרים (container base images) שלכם. לאחר מכן, בדקו את המאגרים הללו אל מול 16,000 המאגרים המנוטרים ב-Gap Map. אם תמצאו התאמות, אישרתם שהתלויות (dependencies) שלכם נמצאות באחד הפינות המאונדקסות הבולטות ביותר בעולם ה-AI בקוד פתוח. לבולטות הזו יש שני צדדים. בדרך כלל זה אומר תחזוקה פעילה ובחינה מצד הקהילה, אך זה גם אומר שתוקפים יודעים שהמאגרים הללו קיימים.

לאחר מכן, הביטו במבנה ה-YAML עצמו. כל אחד מ-1,184 הקבצים מחבר בין מוצרים לבין המאגרים שבבסיסם בפורמט סטנדרטי. תוכלו לכתוב סקריפט פשוט כדי להשוות את מניפסט התלויות (dependency manifests), רשימות החבילות (package lists) או ייצוא ה-SBOM שלכם מול המיפויים הללו. אם תגלו שערמת הייצור (production stack) שלכם מסתמכת על מאגרים שמעולם לא שמעתם עליהם, תעמיקו בבדיקה. תלויות לא ידועות הן המקום שבו מתקפות שרשרת אספקה מתחבאות.

הקדישו תשומת לב מיוחדת לשכבת החומרה. צוותי אבטחה מתמקדים לעיתים קרובות בתוכנה ובמודלים, בעוד שהם מתייחסים לדרייברים (drivers) ול-firmware כרעש רקע. ה-Gap Map מאנדקס במפורש מאגרים הקשורים לחומרה, מה שאמור להזכיר לכם שערמות מנהלי התקני GPU, שרשראות כלי קומפילציה (compiler toolchains) ו-firmware של מאיצים הם גם קוד. יש בהם באגים. הם מתעדכנים. וכשהם אינם מעודכנים, הם יכולים להיות המטרה הרכה ביותר ב-pipeline שלכם.

לבסוף, השתמשו ב-