How AI Accelerator Security Differs Across Vendors: NVIDIA, AMD, Google, Meta
For executives
AI infrastructure runs on four major accelerator ecosystems: NVIDIA GPUs, AMD Instinct, Google TPUs, and Meta MTIA. Each has a different security posture, a different public disclosure history, a different software stack architecture, and a different research exposure. Security teams running multi-vendor AI infrastructure need to understand how these differences translate to different risk profiles. This article compares the four across the dimensions that matter.
Disclosure transparency and CVE coverage
NVIDIA has the most mature and active security disclosure programme. NVIDIA PSIRT publishes quarterly bulletins, responds to external researchers, and since October 2025 has distributed bulletins in machine-readable formats via GitHub. CVE volume is high: 57 CVEs in 2025, representing deep research attention. The high volume reflects both genuine vulnerability density and the research community's active engagement with NVIDIA's large, complex software stack.
AMD publishes security bulletins less frequently and with less structural detail than NVIDIA. The AMD-SB series for graphics accelerators has been increasing in frequency as Instinct adoption grows. CVE-2024-36342 (CVSS 8.8 heap overflow across the MI300 series) and CVE-2024-21969 (Whispering Pixels) represent the beginning of serious external AMD research, not comprehensive coverage.
Google TPU has no public CVE history. Google conducts internal security research on its infrastructure. External researchers cannot meaningfully engage with the TPU security surface because the hardware and software are closed and inaccessible.
Meta MTIA has no public CVE history for the same reasons as TPU — closed hardware, internal deployment only, no external research access.
Software stack openness
NVIDIA's CUDA is proprietary. The GPU driver (nvidia.ko) is partially open-source (kernel interface modules since 2022) but core logic remains proprietary. The Container Toolkit, GPU Operator, and Triton are open-source. SBOM coverage is incomplete for proprietary components.
AMD's ROCm is fully open-source. The amdgpu kernel driver is part of the Linux kernel's mainline codebase. This means any researcher can read the code, fuzz it, and report vulnerabilities via standard kernel security processes. The ROCm userspace libraries are open-source on GitHub.
Google's TPU software stack is internal. XLA (the compiler backend) is open-source; the TPU hardware interface layer is not.
Meta's MTIA software stack is internal PyTorch extensions and deployment tooling. Some components may have open-source equivalents, but the MTIA-specific layers are proprietary.
Container integration and Kubernetes attack surface
NVIDIA has the most complex and therefore most vulnerable container integration: OCI hook-based Container Toolkit with five security bulletins in ten months, GPU Operator with its own CVE history, device plugin with persistent OS package CVEs.
AMD's ROCm container integration is simpler: standard device file access without the hook-based architecture. The specific vulnerability class that produced NVIDIA's Container Toolkit CVE series does not exist in AMD's model.
Google's Cloud TPU is accessed via API — there is no customer-managed container toolkit or device plugin. The container integration complexity is in Google's scope.
Meta MTIA's Kubernetes integration is internal. Standard Kubernetes device plugin patterns are used, but the specific implementation and its security posture are not public.
For security teams: practical implications
For NVIDIA-based infrastructure: active patch management across multiple independently versioned components. Monitor NVIDIA PSIRT bulletins. GPU-specific runtime telemetry is the compensating control for the gap between disclosure and patch deployment.
For AMD Instinct infrastructure: ROCm version currency (ROCm 6.4+ for CVE-2024-36342). Secure GPU Mode enabled for multi-tenant workloads (for CVE-2024-21969). Monitor AMD product security bulletins — their cadence is increasing.
For Cloud TPU: the hardware security surface is in Google's scope. Focus on Cloud TPU API security (authentication, IAM, audit logging) and model artifact supply chain.
For Meta MTIA: this is internal Meta infrastructure. If you are running workloads on Meta platforms that use MTIA, the hardware security posture is in Meta's scope. Focus on API-level controls and data handling policies.