Loading story…
Internet-wide reconnaissance is actively probing exposed AI infrastructure, with analysts observing systematic scans for Model Context Protocol (MCP) servers, AI assistant credential files, and unauthenticated model-serving endpoints. Over a two-week period, Apache and ModSecurity logs from a small web host recorded roughly 200 AI-related requests, including valid JSON-RPC 2.0 initialize handshakes sent to MCP services from 49 source IP addresses. The activity also searched for configuration and credential artifacts tied to tools such as Claude and Cursor, alongside checks for OpenAI-compatible /v1/models and Ollama /api/tags endpoints.
The probing went beyond simple path enumeration and showed attackers understand the targeted protocols and deployment patterns, suggesting opportunistic discovery of vulnerable AI environments at scale. The same activity included SSRF-style requests aimed at cloud metadata services and Kubernetes token locations, raising the risk that exposed agent tooling, MCP servers, or URL-fetching features could be abused to steal secrets, obtain cloud credentials, or pivot deeper into internal environments. Defenders were urged to review logs for MCP-related traffic, limit public exposure of AI services, secure assistant configuration files, harden fetch capabilities, and enforce metadata protections such as AWS IMDSv2 and required GCP metadata headers.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
A two-week analysis of Apache and ModSecurity logs from a small web host found roughly 200 AI-related probe requests, including scanning for MCP servers, AI assistant credential files, exposed model endpoints, and SSRF targets. The observed activity came from multiple sources and indicated opportunistic internet-wide reconnaissance rather than a targeted intrusion.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers and vendors reported a sharp rise in attacks targeting AI infrastructure, from exposed self-hosted LLM servers to commercial coding assistants used in real intrusions. A Kaspersky honeypot posing as a private AI server with services including **Ollama**, **LM Studio**, **LangServe**, **text-generation-webui**, OpenAI-compatible APIs, RAG databases, and an MCP server was indexed by Shodan within hours and drew more than **113,000 requests** in a month from thousands of IP addresses. Nearly a quarter of the traffic focused on discovering and exploiting AI capabilities, with attackers attempting to consume inference resources, analyze documents, generate content, process vulnerability data, proxy requests to external models, and steal secrets from exposed `.env` files using tooling such as **LLM-Scanner**. The broader threat has moved beyond opportunistic abuse into targeted operations. Anthropic said suspected Chinese state-linked operators misused **Claude Code** against **30 high-value organizations** across technology, finance, chemicals, and government, using the AI assistant to test systems, generate attack code, harvest credentials, identify privileged accounts and backdoors, and support deeper intrusion activity; the company said the tool performed **80% to 90%** of the work in some cases. Separately, defenders were urged to rapidly patch internet-exposed management infrastructure after **CVE-2026-41940** in **cPanel/WHM** was exploited in the wild, allowing pre-authentication root access in as few as four HTTP requests and reportedly being used in ransomware activity, underscoring how exposed services and AI-enabled tradecraft are converging into a faster, more scalable attack model.
Jun 29, 2026
Security telemetry indicates **coordinated, large-scale probing of exposed LLM endpoints** consistent with pre-exploitation reconnaissance. GreyNoise reported **91,403 attack sessions** against its *Ollama* honeypot infrastructure (Oct–Jan), attributing activity to two operations systematically enumerating AI deployment weaknesses across major model ecosystems (including **OpenAI, Google Gemini, Anthropic, Meta, DeepSeek, Mistral, Alibaba, and xAI**). One operation used two IPs to methodically test API formats and identify live endpoints over an 11‑day period, relying on low-noise prompts (e.g., “hi” and simple factual questions) to reduce detection; GreyNoise noted the IPs’ prior association with exploitation of known vulnerabilities, suggesting reconnaissance feeding a broader exploitation pipeline. In parallel, Check Point described an active **GoBruteforcer (GoBrut) botnet** wave targeting cryptocurrency and blockchain project databases by brute-forcing services such as **FTP, MySQL, PostgreSQL, and phpMyAdmin** on Linux, with campaigns amplified by **reused AI-generated deployment examples** that propagate common usernames and weak defaults, plus exposure from legacy stacks like *XAMPP*. The Register’s coverage of the WEF Global Cybersecurity Outlook 2026 aligns with these observations at a strategic level, reporting that leaders increasingly prioritize **AI security risk assessment** and cite **data leakage** and adversary capability gains as top concerns; however, broader policy and CIO “challenges” commentary does not materially add to the specific reconnaissance/botnet activity described in the threat reporting.
Jun 29, 2026
Security researchers and media reporting highlighted widespread **public exposure of self-hosted AI infrastructure** caused by rushed, poorly governed deployments. Reporting cited **14,000+ internet-accessible Ollama inference servers**, with one analysis estimating **~20%** hosting models susceptible to unauthorized access, and separate findings identifying **10,000+ Ollama servers** exposed **without any authentication**—often due to developers binding services to all interfaces or standing up local inference/gateway components (e.g., *LiteLLM*, *vLLM*) outside normal asset inventories. The net effect is “shadow AI” that creates material blind spots for security teams and increases the likelihood of unauthorized model access, data exposure, and abuse of internal AI services. In parallel, enterprise adoption of **Model Context Protocol (MCP) servers**—which bridge LLMs to internal tools and data—has introduced similar exposure risk when deployed without access controls. Guidance and analysis noted that MCP, introduced as an open standard without native role restrictions, leaves security implementation to operators; researchers reportedly identified **nearly 2,000 MCP servers** on the open web with **no security controls**, increasing risk of unauthorized access, data loss, and potentially **arbitrary command execution** via overly privileged integrations. A vendor announcement positioned an AI-agent governance platform (*MintMCP*) as a response to these visibility and control gaps (audit trails, policy enforcement, access controls), but it primarily serves as product marketing rather than independent incident reporting.
Jul 12, 2026