Definition
An attack where a maliciously crafted request tricks an AI platform's server into making internal network calls on the attacker's behalf — reaching systems that are normally hidden behind a firewall, including cloud credential stores (AWS/GCP/Azure metadata endpoints), internal databases, and AI model servers. The attacker never directly touches those internal systems; they use the AI server as a proxy.
Why it matters
AI platforms are designed to connect to data sources everywhere, making them natural pivots for SSRF attacks; a single exploitable AI tool can expose an entire cloud environment's credentials and internal services. Multiple platforms in our recent findings — ToolJet, LibreChat, Mattermost, Crawl4AI, LiteLLM — were all vulnerable simultaneously.