Topic starter
25/10/2026 11:06 am
TL;DR: Attackers are using Ollama probing to map exposed AI infrastructure, GreyNoise reports, with one 80,469-session enumeration campaign and a separate SSRF campaign. Exposed AI services need tighter egress and endpoint filtering, or discovery traffic can become the first step toward abuse.
Editorial analysis by NHI Mgmt Group, based on content published by GreyNoise: “Threat Actors Actively Targeting LLMs”.
By the numbers:
- The SSRF campaign spiked to 1,688 sessions in 48 hours over Christmas.
- Attackers probed 73+ LLM model endpoints during the enumeration campaign.
Key questions
Q: Why does large-scale LLM endpoint probing matter before any compromise is visible?
A: Because reconnaissance tells attackers which endpoints exist, which formats are accepted, and which services are worth deeper attention.
Q: How can security teams tell AI probing apart from ordinary user traffic?
A: Look for repeated low-noise requests across many model endpoints, families, or prompt patterns from the same source, especially when the content is deliberately harmless.
Q: What breaks when AI platforms allow untrusted model pulls and outbound callbacks?
A: The platform stops acting as a controlled service and starts acting as an outbound relay for attacker-chosen destinations.
Practitioner guidance
- Restrict model pulls to trusted registries Allow AI platforms to fetch models only from approved sources, and block arbitrary registry URLs or unauthorised remote content retrieval.
- Filter outbound traffic for SSRF containment Apply egress rules so that model-pull paths, webhook handlers, and other fetch functions cannot reach attacker-controlled callback infrastructure.
- Detect enumeration across model endpoints Alert when a single source probes multiple AI endpoints, model families, or prompt formats in a short window, even if each request looks harmless.
Bottom line: Attackers are probing AI platforms as a reconnaissance target, not only as a direct compromise target.
Glossary terms: Server-Side Request Forgery, API Enumeration, Out-of-Band Application Security Testing, Egress Filtering
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 7 days ago by NHI Mgmt Group
27/10/2026 7:17 pm
AI deployment reconnaissance is now a governance problem, not just a detection problem. Attackers are learning which model endpoints exist, which request patterns succeed, and which outbound channels will validate their payloads. That means exposed AI systems are being profiled before they are exploited, and the governance gap sits at the boundary between application behaviour and network trust. Teams need to treat exposed AI services as managed attack surfaces, not passive workloads.
A few things that frame the scale:
- 40 percent of financial and software companies have already deployed agentic AI systems, and deployments are expected to double by 2028.
A question worth separating out:
Q: Should organisations prioritise egress control or endpoint rate limiting for exposed LLM services?
A: They should do both, but egress control usually reduces the blast radius first because it blocks SSRF validation and callback confirmation. Rate limiting is still important for discovery and scraping, yet it does not stop a service from phoning home if outbound access remains broad. The right order is to cut trust in external requests, then tune volume controls.
👉 Read our full editorial: AI deployment reconnaissance is exposing LLM and SSRF gaps
This post was modified 7 days ago by NHI Mgmt Group