Look for repeated low-noise requests across many model endpoints, families, or prompt patterns from the same source, especially when the content is deliberately harmless. Normal user traffic is usually narrower and more task-specific. Probing traffic often looks like behaviour testing, not application use, even when the payloads themselves appear benign.
What probing traffic looks like in the request pattern
Security teams usually spot probing by the shape of the traffic, not by any single malicious payload. The tell is repeated, low-noise requests that fan across many model endpoints, model families, or prompt variants from the same source. That pattern looks like testing system boundaries and responses, while ordinary user traffic is usually narrower, more stable, and tied to a specific task.
Benign prompts can still be part of probing, so the content itself is not enough. A harmless-looking question can be used to measure filters, compare model behaviour, or map which endpoints answer differently. The more the requests vary in small ways while the source stays consistent, the more the traffic resembles reconnaissance rather than normal application use.
For teams that already monitor AI gateways or inference APIs, the most useful signal is repetition with intent to compare. One-off requests, even unusual ones, are less informative than a sequence that changes wording, target, or prompt structure in a controlled way.
How to separate probing from normal usage with the surrounding context
Context matters because ordinary traffic usually carries a business task, a user workflow, or a known integration path. Probing often lacks that operational context and instead shows breadth: many endpoints, many prompt families, many slight variations, little progression toward a real user outcome. In practice, that means looking at session shape, source consistency, and whether the traffic keeps exploring after it has already received an answer.
Another useful distinction is whether the source behaves like a human or an automated testing client. Humans tend to converge on a task once the system starts responding usefully. Probing sources often continue to vary prompts after receiving enough information to classify the model, the safety boundary, or the endpoint catalogue. That persistence is a strong behavioural clue even when each individual request seems harmless.
Teams should also compare the traffic against normal baselines for the application, tenant, or customer segment. A burst of short, low-signal requests may be normal in one workflow and suspicious in another. The point is not to flag all exploratory behaviour, but to find sources that are systematically measuring the environment rather than completing a legitimate interaction.
What defenders should watch when probing stays harmless on the surface
Harmless-looking probing can still be useful to an attacker because it maps model behaviour, guardrail differences, and endpoint inventory without triggering obvious alarms. If the traffic is allowed to blend into standard usage, it can create a blind spot for later abuse, especially when the same source returns with higher-risk prompts or starts targeting a more permissive path. MITRE ATT&CK Enterprise Matrix is useful here because it encourages defenders to treat this as reconnaissance behaviour, not just content inspection.
Failure mechanism: Teams over-weight prompt content and under-weight sequence behaviour, so repeated testing across endpoints is treated as normal usage until the source escalates or pivots.
Impact: That gap lets an attacker map model boundaries, compare responses, and identify weak spots for later abuse without needing obviously malicious payloads.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK, OWASP API Security Top 10 and OWASP Agentic AI Top 10 address the attack and risk surface, while NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1595 — Active Scanning | Probing across endpoints is reconnaissance that maps system behavior. |
| Recommendation — Map repeated endpoint testing to Active Scanning and alert on source-level exploration patterns. | ||
| NIST CSF 2.0 | DE.AE-01 — Anomalous events are detected and analyzed | Traffic shape analysis is central to distinguishing probing from normal use. |
| Recommendation — Tune detections to flag repeated low-noise exploration across AI endpoints. | ||
| OWASP API Security Top 10 | API9 — Improper Inventory Management | Probing often targets many model endpoints to discover exposed surfaces. |
| Recommendation — Inventory AI endpoints and monitor for unexpected discovery-oriented request patterns. | ||
| OWASP Agentic AI Top 10 | ASI06 — Memory & Context Poisoning | Repeated harmless prompts can be used to test context and boundary behavior. |
| Recommendation — Treat boundary-testing traffic as a precursor to context manipulation attempts. | ||
| NIST SP 800-53 Rev 5 | AU-6 — Audit Record Review, Analysis, and Reporting | Sequence-level review is needed to distinguish benign use from probing. |
| Recommendation — Review AI access logs for repeated exploratory requests from the same source. | ||
Practitioner Guidance
What to prioritise: Focus first on source-level behaviour, not prompt-by-prompt review. A single source that repeatedly hits multiple endpoints, model variants, or prompt shapes deserves more attention than an isolated odd prompt from an otherwise normal session.
What to verify: Check whether the traffic has a real business trail, such as an authenticated workflow, expected tool use, or a consistent user goal. If the requests keep changing while the task does not converge, treat that as a stronger signal than the prompt text alone. NIST Cybersecurity Framework 2.0 and MITRE ATT&CK Enterprise Matrix both support this kind of detection-led review.
Common mistake: Assuming harmless payloads are harmless activity. Probing often uses benign content precisely because the value lies in observing system behaviour, not in triggering an obvious block.
Practitioner takeaway: If the source is exploring breadth, variation, and boundary behaviour, classify it by intent and sequence, not by whether each individual prompt looks dangerous.
Related resources from NHI Mgmt Group
- What steps should security teams take to prevent Shadow AI risks?
- How do security teams tell theft apart from ordinary administration?
- How can security teams tell credential stuffing from ordinary user login failures?
- How should security teams detect a supply chain backdoor when network tools cannot tell it apart from normal protocol traffic?