Threat Actors Launch Mass Reconnaissance of AI Systems

A large scale reconnaissance campaign targeting major commercial model providers is likely meant to map the expanding surface areas of artificial intelligence deployments.

See Also: Proof of Concept: Bot or Buyer? Identity Crisis in Retail

Security monitoring platform GreyNoise captured 91,403 attack sessions against its Ollama honeypot infrastructure from October through this month, revealing two operations systematically looking for AI deployment vulnerabilities. The campaigns hit models from OpenAI, Anthropic, Meta, Google, DeepSeek, Mistral, Alibaba and xAI.

One of the campaigns generated particular concern among security researchers. Two internet protocol addresses launched on Dec. 28 methodically probed against more than 73 large language model endpoints over 11 days, creating 80,469 sessions that tested API formats for OpenAI and Google Gemini.

The attackers used innocuous test queries to avoid triggering security alerts. Simple prompts dominated the reconnaissance traffic: The greeting “hi” appeared most frequently, while questions like “How many states are there in the United States?” and “How many letter ‘r’ are in the word strawberry?” served to identify active endpoints without initially raising suspicion.

Both IP addresses have a history of exploiting known vulnerabilities, suggesting the enumeration feeds into a larger exploitation pipeline. GreyNoise assessed the campaign was likely conducted by a professional threat actor. “80,000 enumeration requests represent investment,” GreyNoise said. “Threat actors don’t map infrastructure at this scale without plans to use that map.”

The other campaign, which began in October, exploited server-side request forgery vulnerabilities. These flaws force servers to make outbound connections to attacker-controlled infrastructure. The operation showed a dramatic spike around Dec. 25, generating 1,688 sessions within two days.

Attackers targeted two vectors during this campaign. They injected malicious registry URLs through Ollama’s model pull functionality, forcing servers to make HTTP requests to attacker infrastructure. They also manipulated MediaUrl parameters in Twilio SMS webhook integrations to trigger outbound connections.

The campaign used ProjectDiscovery’s Out-of-Band Application Security Testing infrastructure to confirm exploitation through callback validation. This technique allows attackers to verify that a server performed the requested action by checking whether it connected back to their controlled system.

Network fingerprinting revealed operational structure, with a single JA4H signature appearing in 99% of attacks. JA4H is a fingerprinting method that identifies patterns in how applications communicate over networks, and this signature pointed to shared automation tooling that likely involved Nuclei, a popular vulnerability scanning framework.

The 62 source IP addresses were spread across 27 countries, but consistent fingerprints indicate virtual private server-based infrastructure rather than botnet operations.

GreyNoise assessed this campaign as probably originating from security researchers or bug bounty hunters, saying that OAST callbacks represent standard vulnerability research techniques. But the scale and holiday timing suggest operations pushing boundaries.

The campaigns targeted organizations running exposed LLM endpoints, hunting specifically for misconfigured proxy servers that might leak access to commercial APIs.