What Meta MTIA Is: Closed-Architecture Custom Silicon and What That Means for Security
For executives
Meta's Training and Inference Accelerator (MTIA) is a family of custom AI chips designed and deployed by Meta for its internal AI workloads — ranking, recommendation, and increasingly generative AI inference. As of May 2026, Meta has deployed hundreds of thousands of MTIA chips across its data centres, with four generations (MTIA 300, 400, 450, 500) deployed or in production. MTIA is built on a RISC-V architecture and co-designed with Broadcom. Unlike NVIDIA or AMD silicon, MTIA is not commercially available and has no public CVE history. This article covers what MTIA is and what its closed nature means for anyone trying to assess its security posture.
What MTIA does
MTIA is designed specifically for Meta's AI workloads: ranking and recommendation models (the systems that decide what content appears in users' Facebook, Instagram, and Threads feeds), and more recently generative AI inference tasks like image and video generation. Meta claims MTIA delivers efficiency advantages over vendor silicon for these specific workloads.
MTIA chips are not sold or rented to external parties. They are not available via any cloud service. They run Meta's workloads, in Meta's data centres, on Meta's infrastructure. The security boundary is internal to Meta.
MTIA's architecture
MTIA uses a RISC-V instruction set architecture — an open-source ISA that Meta chose for its flexibility and royalty-free nature. The chip design is a modular chiplet design: MTIA 300 consists of one compute chiplet, two network chiplets, and HBM stacks. Future generations are designed to be interoperable with existing rack infrastructure.
The software stack is built on top of industry-standard frameworks: PyTorch for model development, and Meta's internal tooling for deployment. Meta describes MTIA as designed to "drop into existing rack system infrastructure" — it integrates with standard Kubernetes-based orchestration.
What the closed nature means for security verifiability
No CVEs have been published for MTIA hardware or software. No security bulletins exist. No external researchers have published findings on MTIA's security properties. This is not evidence that MTIA is secure — it is evidence that its security is not externally auditable.
The hardware design is proprietary and not described in publicly available security documentation. The chip microarchitecture, memory isolation model, process separation mechanisms, and firmware architecture are not published.
The software stack integration with Kubernetes means that container-level vulnerabilities that affect GPU deployments (Container Toolkit CVEs, device plugin vulnerabilities) may have analogues in MTIA's Kubernetes integration — but the specific attack surface is unknown without access to Meta's internal tools.
Why this matters for security-conscious AI infrastructure
Organisations that use vendor AI accelerators (NVIDIA, AMD) can assess the security posture of those accelerators via public CVE databases, security bulletins, PSIRT programmes, and an active research community. The security posture of the accelerator is externally auditable.
Organisations that use cloud services that run on Meta infrastructure — directly or indirectly — cannot audit MTIA's security posture. The trust model is: trust Meta's internal security processes.
For Meta itself, the MTIA security posture is an internal responsibility. Meta operates its own security programme, and responsible disclosure of MTIA vulnerabilities would flow through internal channels rather than public CVE assignment.
The broader custom silicon trend
MTIA is not unique. AWS has Trainium and Inferentia. Google has TPU. Microsoft is developing Maia AI chips. Each hyperscaler or major AI operator is building custom silicon to reduce dependence on NVIDIA and to optimise for their specific workloads. None of these custom chips has significant public security research coverage.
As these chips are deployed at scale, the security research community will increasingly examine them. The first significant public finding on any hyperscaler custom silicon will mark a shift in the security conversation — from "GPUs are the attack surface" to "any AI accelerator at scale is an attack surface."