Tencent’s Zhuque Lab Releases AI-Infra-Guard Scanner for AI Systems
Summary
Tencent’s Zhuque Lab released AI-Infra-Guard, which scans AI services for CVEs, inspects MCP servers and agent skills, and evaluates jailbreak resistance. Its open-source build lacks authentication and should be protected behind external access controls.
Key points
- AI-Infra-Guard fingerprints services including Ollama, vLLM, and ComfyUI and checks them against more than 1,600 CVEs.
- It inspects MCP servers and agent skills across 14 risk categories and runs jailbreak evaluations against target models.
- SkillTrustBench contains 5,520 human-labeled samples; reported false-positive rates for malicious-skill detection range from 1.20% to 18.67%, depending on the judging model.
- Release 4.1.9 separates scanned content from instructions to mitigate indirect prompt injection; the team says this is not a formal guarantee.
- The open-source build has no authentication or role-based access control. Zhuque Lab recommends a reverse proxy with authentication or an IP allowlist, plus firewall rules.
Article Details
- Event Type
- Release of AI-Infra-Guard, an open-source security scanner for AI systems.
- Impact
- The scanner fingerprints AI services, checks for more than 1,600 known CVEs, inspects MCP servers and agent skills, and evaluates models for jailbreak resistance. Its skill checks can produce false positives ranging from 1.20% to 18.67%, depending on the judging model. The open-source build has no authentication and may expose evaluated models’ API keys if reachable without external access controls. Release 4.1.9 adds a mitigation for indirect prompt injection, which the team says is not a formal guarantee.
Products
AI-Infra-GuardTencent’s Zhuque Lab released AI-Infra-Guard, an open-source scanner for AI systems that fingerprints services like Ollama, vLLM, and ComfyUI, checks thousands of CVEs, inspects MCP servers and agent skills, and testsComfyUIAI-Infra-Guard, an open-source scanner for AI systems that fingerprints services like Ollama, vLLM, and ComfyUI, checks thousands of CVEs, inspects MCP servers and agent skills, and tests models for jailbreakOllamaZhuque Lab released AI-Infra-Guard, an open-source scanner for AI systems that fingerprints services like Ollama, vLLM, and ComfyUI, checks thousands of CVEs, inspects MCP servers and agent skills, and tests models forSkillTrustBench#AI-Infra-GuardvLLMLab released AI-Infra-Guard, an open-source scanner for AI systems that fingerprints services like Ollama, vLLM, and ComfyUI, checks thousands of CVEs, inspects MCP servers and agent skills, and tests models for