attack-surface

Disabling SGLang's direct Pickle transport changed the envelope and left the decoder in place. How both internal receive modes reached Pickle, and how a reachable internal receiver turned that into code execution in a real two-GPU service.

A scanner finds the services. The real shape of an AI estate lives in the hidden connections carrying credentials, trust, and data between them.

The model is one process. Around it sits the infrastructure that serves it, tracks it, stores its data, and wires it into everything else. This is a map of the services and seams that make up a modern model estate.