We Analyzed 12,000+ GPUs. Here’s What We Found About the AI Boom

The world is racing to build AI data centers, but where is all that computing power, how much is being used, and how much can outsiders see? During our security research at Lava, we analyzed publicly exposed NVIDIA GPU monitoring systems and identified more than 12,000 unique GPUs across just over 2,000 unique public IP addresses, associated with nearly 300 organizations. Here’s what we found.

Blackwell Ultra GPUs on Chinese Networks

During our research, we identified 32 NVIDIA B300 GPUs, part of NVIDIA’s Blackwell Ultra generation, through publicly exposed monitoring endpoints with IP addresses geolocated to China. The endpoints disclosed exact GPU model names and unique device identifiers (UUIDs) without authentication, allowing us to identify individual GPUs.

These 32 B300s were part of a much larger inventory. Across multiple scans examining NVIDIA DCGM Exporter exposure, we identified 4,724 unique NVIDIA GPUs through publicly accessible monitoring endpoints with IP addresses geolocated to China.

It is important to note that IP geolocation is not definitive: a proxy, VPN, or tunnel could relay traffic through an address in China while the hardware itself is physically located elsewhere.

The B300 finding is particularly significant in the context of U.S. export controls on advanced AI chips. NVIDIA’s Blackwell Ultra accelerators are among the most advanced GPUs available, and shipments of such hardware to China are subject to stringent U.S. export licensing requirements. The discovery raises questions about the location and supply chain of the reported hardware, although it does not establish that any export-control violation occurred.

Beyond the B300s, our China-associated inventory included additional Blackwell GPUs. In total, we identified 374 GPUs across the four NVIDIA Blackwell models listed below. While these models differ in their intended use and export-control classifications, their presence in the exposed monitoring data provides additional insight into the advanced hardware reported through China-geolocated IP addresses.

The other Blackwell models in our inventory have different regulatory considerations. NVIDIA’s RTX PRO 6000 Blackwell Server Edition and the standard GeForce RTX 5090 differ from the modified versions developed for the Chinese market, including the RTX PRO 6000D and RTX 5090D. The RTX PRO 5000 Blackwell also requires separate assessment based on its exact specifications and export classification. Identifying these models through China-geolocated IP addresses does not, by itself, establish that they were exported in violation of regulations.

We also examined how these GPUs were configured. Our initial analysis suggests that approximately 86% of the 374 Blackwell GPUs were reported in eight-GPU configurations, consistent with compute servers rather than individual desktop workstations.

Consumer GPUs in Compute Infrastructure

The Blackwell GPUs were only part of the picture. Our China-associated inventory also included 1,156 NVIDIA RTX 4090 GPUs, a consumer graphics card subject to U.S. export restrictions since 2023, alongside 160 RTX 4090D GPUs, a modified version NVIDIA developed for the Chinese market.

These configurations suggest that many consumer GPUs were being used for compute workloads rather than individual desktop gaming. The 1,156 RTX 4090 GPUs were reported across 117 monitoring endpoints, with 74 endpoints reporting exactly eight GPUs each, a configuration commonly associated with AI compute servers. All 160 RTX 4090D GPUs were also reported in eight-GPU configurations. While monitoring endpoints can aggregate multiple machines, these patterns suggest that consumer graphics cards are being deployed as part of larger compute environments.

This pattern was not limited to China-associated endpoints. Across our original global sample, approximately half of the GPUs identified through exposed monitoring systems were consumer or workstation-class models, highlighting their substantial presence in the infrastructure visible through our research.

Nearly 60% Reported Zero Utilization

The same monitoring systems that exposed GPU inventories also revealed utilization metrics. Across our original global sample, nearly 60% of GPUs reported 0% utilization at the time of observation.

While these measurements represent snapshots rather than continuous monitoring, they provide a rare glimpse into the operational state of thousands of GPUs. A GPU reporting zero utilization at a particular moment may have been running workloads before or after the observation, and our sample does not represent utilization across the broader AI industry.

Beyond the utilization figures themselves, the findings demonstrate how publicly accessible monitoring systems can expose operational information about AI computing environments to external observers.

The Infrastructure Around the GPUs Was Exposed Too

These findings were possible because monitoring systems intended for internal infrastructure management were publicly accessible. Without authentication, external observers could identify GPU models, hardware configurations, device identifiers, and utilization patterns. For AI data centers operating valuable workloads, this information can provide potential attackers with detailed intelligence about the underlying infrastructure.

In a separate analysis, we identified 12,096 public server-monitoring endpoints exposing high-speed networking information. Many also revealed operating systems and firmware details, and where GPU and server monitoring overlapped, we could connect the accelerators to the surrounding infrastructure. These details can help attackers select targets and search for relevant vulnerabilities, while repeated observations reveal changes in activity over time.

SemiAnalysis described a related failure in Most Neoclouds Suck At Security. An initial Grafana misconfiguration exposed another tenant’s information. Further investigation revealed that the underlying Prometheus API credential could retrieve logs and metrics across tenants, extending the exposure beyond what appeared in the dashboard.

The exposure we observed crossed GPU clouds, hosting networks, telecoms, and research environments. Our original investigation also uncovered CVE-2026-47483, an unauthenticated denial-of-service vulnerability in DCGM Exporter that NVIDIA addressed in version 4.8.2.

As AI data centers continue to scale, protecting the systems that manage and monitor their infrastructure becomes increasingly important. GPU monitoring endpoints should be accessible only to authorized systems, with appropriate authentication and network restrictions.

Our research demonstrates that even when workloads themselves remain protected, publicly exposed infrastructure telemetry can reveal valuable information about the hardware, configuration, and operational state of AI computing environments.

Read Lava’s original research on exposed GPU monitoring and the NVIDIA DCGM Exporter vulnerability