Open-source AI has grown into a sprawling ecosystem where a single product might pull code from dozens of repositories, rely on training data from multiple sources, and run on specialized hardware configurations that few teams fully document. Keeping track of these dependencies is hard. Understanding which parts of that stack are exposed to the internet is harder. Current AI's release of the Open Source AI Gap Map v0.1 attempts to bring some order to that chaos, and security teams should treat it as required reading.
The index catalogs 421 open-source AI products. It breaks them down into four categories: AI models, datasets, software tools, and hardware. Under the hood, the entire project runs on 1,184 YAML files that track more than 16,000 GitHub repositories. That gap between 421 products and 16,000 repositories tells its own story. Most AI applications are not self-contained monoliths. They are assemblies of inference engines, fine-tuning scripts, data loaders, evaluation benchmarks, and driver layers, each living in its own repository with its own maintainers, commit histories, and vulnerability profiles.
Current AI published the dataset under an MIT license and made it fully public. That openness is the point. Anyone can download it, parse the YAML, and build tooling on top of it. For defenders, that accessibility is an opportunity. For attackers, it is equally convenient.
What the Map Actually Tracks
Most organizations using AI do not have a clear inventory of what they have deployed. A team might download a language model from a popular hub, install a few Python packages to run it, and call the job done. But underneath that simple workflow sits a nested set of dependencies. The model weights come from one repository. The tokenizer configuration comes from another. The inference framework might be a fork of a third project. The CUDA drivers and container images pull from yet more sources.
The Gap Map captures this by organizing its 1,184 YAML files around 421 distinct AI products. The over 16,000 GitHub repositories mapped here represent the actual code, configurations, and artifacts that make those products function. By separating entries into models, datasets, software tools, and hardware, the index forces a basic question: do you know which of these four layers your systems actually touch?
If you are running an open-source large language model in production, you are likely touching all four. You depend on the model weights and architecture. You depend on the datasets used for pre-training or fine-tuning, even if you never downloaded them directly. You depend on software tools to convert, quantize, or serve the model. And if you are running on GPUs or specialized accelerators, you depend on firmware and driver stacks that fall under the hardware category.
The Security Double-Edged Sword
This dataset serves two masters, and security leaders need to understand both sides.
On the defensive side, the Gap Map functions like a phone book for your AI supply chain. You can compare the repositories and tools your organization depends on against this index and spot gaps in your visibility. If a critical repository appears in the map but not in your software bill of materials, you have likely found shadow AI infrastructure. That is worth knowing before an adversary finds it for you.
On the offensive side, the dataset is reconnaissance gold. Attackers constantly scan for exposed AI infrastructure, model serving endpoints, and vulnerable dependencies in popular ML pipelines. The Gap Map gives them a machine-readable, structured list of targets organized by exactly the categories they care about. A single YAML parser can extract thousands of repository URLs, and from there an attacker can cross-reference known vulnerabilities, look for misconfigured public instances, or identify high-value targets for dependency confusion attacks.
Because the data is MIT-licensed and public, there is no barrier to entry. No subscription, no approval process. That design choice maximizes utility for researchers and defenders, but it also maximizes utility for threat actors. The same file that helps you harden your stack helps someone else build a target list.
What to Do With This Information
Treat this dataset exactly as you would treat a threat intelligence feed. Do not bookmark it and forget it. Run an active check against your environment.
Start by pulling a list of every open-source AI component your teams currently use. Look beyond the obvious. Ask which repositories supply your tokenizers, your evaluation scripts, your quantization libraries, and your container base images. Then check those repositories against the 16,000 tracked in the Gap Map. If you find matches, you have confirmed that your dependencies live in one of the most prominently indexed corners of the open-source AI world. That prominence cuts both ways. It usually means active maintenance and community scrutiny, but it also means attackers know these repositories exist.
Next, look at the YAML structure itself. Each of the 1,184 files connects products to their underlying repositories in a standardized format. You can write a simple script to compare your dependency manifests, package lists, or SBOM exports against these mappings. If you discover that your production stack relies on repositories you had never heard of, dig deeper. Unknown dependencies are where supply chain attacks hide.
Pay special attention to the hardware layer. Security teams often focus on software and models while treating drivers and firmware as background noise. The Gap Map explicitly indexes hardware-related repositories, which should remind you that GPU driver stacks, compiler toolchains, and accelerator firmware are code too. They have bugs. They get updated. And when they are out of date, they can be the softest target in your pipeline.
Finally, use the