Local AI runtimes expand developer attack surface, Docker fixes highlight risks

Security researchers and developers are underestimating the attack surface introduced by local AI runtimes, which span model distribution channels, inference backends, local API servers, caches, and GPU libraries rather than being a single isolated process. Docker's 2024 security advisories for its Model Runner feature included container-to-host code execution vulnerabilities in two inference backends, a server-side request forgery (SSRF) flaw in the OCI registry client, and runtime flag injection issues. The SSRF vulnerability is notable because local runtimes can access internal registries, VPN-only services, localhost APIs, and developer credentials, making the threat model meaningfully different from — but not less serious than — cloud-based SSRF attacks. Docker Model Runner supports pulling models from Docker Hub, OCI registries, and Hugging Face, then serving them via OpenAI and Ollama-compatible APIs, creating a broad supply chain that deserves the same security scrutiny applied to other developer infrastructure. The core concern is not whether a model file itself is malicious, but rather what the entire pipeline from model discovery to inference is permitted to access on a developer's machine.