Security research firm Lava has identified 32 NVIDIA B300 GPUs, part of NVIDIA’s Blackwell Ultra generation, on networks in China through publicly exposed monitoring endpoints that disclosed exact model names and device identifiers without any authentication. According to Lava’s report, updated on October 23, the firm analyzed publicly accessible NVIDIA DCGM Exporter endpoints and identified more than 12,000 unique GPUs across just over 2,000 public IP addresses associated with nearly 300 organizations. Shipments of B300-class hardware to China are subject to stringent US export licensing, so the finding raises questions about the location and supply chain of the hardware — although Lava stresses that IP geolocation is not definitive and that the discovery does not establish any export-control violation.
What Lava found in the exposed endpoints
The 32 B300s were part of a much larger inventory. Across multiple scans, Lava identified 4,724 unique NVIDIA GPUs through publicly accessible monitoring endpoints with IP addresses geolocated to China. Beyond the B300s, the China-associated inventory included 374 GPUs across four Blackwell models: 32 B300 SXM6 AC cards, 78 RTX PRO 6000 Blackwell Server Editions, 112 RTX PRO 5000 72GB cards and 152 GeForce RTX 5090s. Around 86% of those 374 GPUs were reported in eight-GPU configurations, a pattern consistent with compute servers rather than individual desktop workstations.
The inventory also included 1,156 NVIDIA RTX 4090 GPUs, a consumer card subject to US export restrictions since 2023, alongside 160 RTX 4090D GPUs, a modified version NVIDIA developed for the Chinese market. The 1,156 RTX 4090s were reported across 117 monitoring endpoints, with 74 endpoints reporting exactly eight GPUs each. All 160 RTX 4090D GPUs were also reported in eight-GPU configurations. Lava notes that monitoring endpoints can aggregate multiple machines, but the pattern suggests consumer graphics cards are being deployed as part of larger compute environments.
The export-control question and its limits
The B300 finding is significant because NVIDIA’s Blackwell Ultra accelerators are among the most advanced GPUs available, and their shipment to China requires US export licenses. Lava is careful about what its data proves: a proxy, VPN or tunnel could relay traffic through an address in China while the hardware itself is physically located elsewhere. Identifying these models through China-geolocated IP addresses does not, by itself, establish that they were exported in violation of regulations.
The report adds regulatory nuance for the other Blackwell models. NVIDIA’s RTX PRO 6000 Blackwell Server Edition and the standard GeForce RTX 5090 differ from the modified versions developed for the Chinese market, including the RTX PRO 6000D and RTX 5090D. The RTX PRO 5000 Blackwell also requires separate assessment based on its exact specifications and export classification.
Nearly 60% of GPUs sat idle, and the monitors themselves were exposed
The same monitoring systems that exposed GPU inventories also revealed utilization metrics. Across Lava’s global sample, nearly 60% of GPUs reported 0% utilization at the time of observation. Lava cautions that these measurements are snapshots rather than continuous monitoring, and that the sample does not represent utilization across the broader AI industry.
The deeper finding is infrastructural. These systems were meant for internal management, yet they exposed GPU models, hardware configurations, device identifiers and utilization patterns to any external observer. Lava separately identified 12,096 public server-monitoring endpoints exposing high-speed networking information, operating systems and firmware details. Its investigation also uncovered CVE-2026-47483, an unauthenticated denial-of-service vulnerability in DCGM Exporter that NVIDIA addressed in version 4.8.2.
Why It Matters
The research shows how publicly exposed infrastructure telemetry can reveal the hardware, configuration and operational state of AI computing environments, even when the workloads themselves are protected. For data center operators, an unprotected monitoring endpoint hands potential attackers detailed intelligence: which accelerators are running, how they are configured, and when they sit idle. The exposure crossed GPU clouds, hosting networks, telecoms and research environments, so it is an industry-wide hygiene problem rather than one operator’s mistake.
For NVIDIA and US export policy, the 32 B300s will feed a sharper supply-chain question. The finding does not prove a violation, but it is the kind of concrete inventory data regulators and analysts lacked: individual export-controlled GPUs visible on networks with Chinese IP addresses. With consumer RTX 4090s appearing in server-scale eight-GPU configurations as well, the line between consumer hardware and restricted compute keeps blurring — even as Chinese chipmakers such as Cambricon push Nvidia replacements at home.
Background
The US has restricted exports of advanced AI chips to China since 2022, with the RTX 4090 added to the restricted list in 2023. NVIDIA has responded with China-specific modified models such as the RTX 4090D and RTX 5090D, designed to stay within the rules. NVIDIA’s hardware supply chain is in motion elsewhere too: Samsung is tapping TSMC’s 3nm lines for NVIDIA’s next-generation memory. Lava’s report is part of a growing body of research showing how exposed internal tooling — monitoring endpoints, Grafana dashboards, Prometheus APIs — leaks operational intelligence about AI infrastructure, a theme SemiAnalysis has also documented among neoclouds.
Source: Lava
0 Comments