Cybersecurity firm Resecurity has published a detailed technical advisory documenting how foreign adversaries are systematically probing artificial intelligence infrastructure.
The company reports ongoing reconnaissance activity aimed at mapping exposed AI and machine learning instances back to specific organizations, as a precursor to data breaches that exploit misconfigured services and applications.
For defense and national security institutions, the warning lands at an uncomfortable moment. Militaries and defense contractors are standing up inference pipelines, model registries, and orchestration platforms faster than security practices can mature around them — and Resecurity’s research suggests attackers already understand this gap better than many defenders do.
A Different Reconnaissance Landscape
Traditional network security assessments follow predictable patterns: web servers on ports 80 and 443, SSH on port 22, databases on their standard ports. Security teams have spent years building tooling and institutional intuition around this map.
AI infrastructure breaks that map.
According to Resecurity, modern AI deployments expose an entirely different and far larger set of components: inference servers, vector databases, model registries, orchestration platforms, notebook environments, and GPU-backed compute.
Each of these systems tends to expose multiple protocols simultaneously — HTTP APIs, gRPC interfaces, Prometheus metrics endpoints, and management consoles — creating a reconnaissance surface that dwarfs a conventional web application.
The core problem, as Resecurity frames it, is that AI environments leak an unusual volume of operational intelligence: information about how a system is built and run, not just what it serves.
APIs, metrics endpoints, metadata, and orchestration dashboards routinely disclose details that would never appear in a traditional application’s attack surface.
Why AI Systems Are High-Value Target
Resecurity’s analysis identifies why attackers are prioritizing AI infrastructure specifically. Because machine learning environments are highly interconnected, compromising a single component such a notebook, an orchestration platform, or a model registry can expose an organization’s entire ML ecosystem at once.
A misconfigured Jupyter notebook, for instance, can provide direct visibility into storage systems, inference servers, vector databases, and deployment pipelines simultaneously.
Attacker objectives vary by actor profile. Cybercriminal groups are generally financially motivated, chasing stolen data and ransomware payouts. Nation-state and advanced cyberespionage groups, by contrast, are focused on intellectual property theft; a distinction with obvious implications for defense contractors developing proprietary targeting, autonomy, or ISR models.
Resecurity also documents a set of attack vectors unique to the AI stack:
- GPU hijacking, redirecting compute toward cryptomining or unauthorized AI workloads
- Supply chain poisoning, through malicious models or tampered dependencies introduced upstream
- RAG manipulation and vector database tampering, corrupting the retrieval layer that many AI assistants and copilots rely on for factual grounding
- Cloud credential theft, harvested from notebook environments where secrets are frequently stored in plaintext
- Operational intelligence gathering, via metrics and metadata leakage that reveals internal project names, deployment stages, and infrastructure design
The firm also notes that the sheer architectural complexity of AI systems is already straining incident response: investigating a suspected compromise across an interconnected ML pipeline is resource-intensive, and Resecurity warns this is dragging down Mean-Time-to-Detect and Mean-Time-to-Respond metrics industry-wide.
Mapping Exposed Components
Resecurity’s advisory catalogs the specific systems most commonly found exposed during reconnaissance, along with why each matters:
Model serving endpoints. Frameworks like NVIDIA Triton Inference Server, TensorFlow Serving, and TorchServe typically expose separate HTTP, gRPC, and metrics interfaces for a single service, meaning an attacker can often map deployment architecture without ever touching the actual inference API. LLM-specific servers such as Ollama and vLLM add another layer, frequently exposing OpenAI-compatible APIs by default.
Orchestration and experiment tracking. Platforms such as MLflow, Kubeflow, and Ray centralize an organization’s entire AI operation: training experiments, hyperparameters, artifact storage locations, and pipeline definitions. Resecurity specifically cites the “ShadowRay” campaign, which targeted exposed Ray dashboards, as a real-world example of how dangerous a publicly accessible orchestration system can become.
Vector databases. Platforms like Qdrant, Weaviate, Milvus, and Chroma store the embeddings that power retrieval-augmented generation and semantic search. Exposed instances can reveal collection names, embedding dimensions, and even the likely use case behind an internal AI application, intelligence that maps directly to what an organization’s AI systems are built to do.
Model registries. These systems function as the central inventory for an organization’s AI assets, storing serialized model files, version history, and ownership metadata.
Supporting infrastructure. Jupyter notebooks, commonly run without authentication on port 8888, are singled out as a persistent weak point, frequently containing cleartext credentials, API keys, and cloud access tokens inside notebook cells themselves. Object storage platforms like MinIO, and Prometheus metrics endpoints, round out the list of commonly overlooked exposure points.
How Attackers Fingerprint AI Services
A significant portion of Resecurity’s advisory is devoted to the fingerprinting techniques used to identify AI infrastructure once network scanning turns up an unfamiliar service.
These include analysis of HTTP response headers (many frameworks unintentionally identify themselves, such as TorchServe’s Server: TorchServe banner), JSON response structures specific to each framework, deliberately triggered error messages that reveal internal namespaces and file paths, and endpoint-naming conventions, as AI services tend to expose action-oriented routes like /predict, /generate, and /embeddings rather than the resource-based patterns typical of conventional REST APIs.
gRPC services present a particular challenge for defenders: because they use binary protobuf communication over HTTP/2, traditional HTTP scanners frequently fail to detect them even when a fully functional inference API is running behind the port.
Where gRPC reflection is left enabled — common in development environments pushed into production without hardening — tools like grpcurl can enumerate the entire exposed service schema.
Recurring Misconfigurations
Resecurity is direct about the nature of the threat: the most dangerous exposures are rarely novel zero-days. They are routine deployment mistakes repeated across thousands of environments, driven by a development culture that prioritizes rapid experimentation over security hardening.
Documented examples include MLflow instances that shipped without authentication enabled by default prior to version 2.x; Kubeflow dashboards exposed through load balancers or public ingress with incomplete identity controls, where notebook servers often inherit broad Kubernetes service account permissions; and TorchServe’s management API, which, if left publicly accessible, can be instructed to load attacker-controlled model archives, leading directly to code execution during model initialization.
The Supply Chain Dimension
The advisory also addresses risk further upstream. AI systems commonly pull pretrained models and dependencies from external sources such as Hugging Face Hub, PyTorch Hub, and public package registries.
Resecurity flags exposed Hugging Face access tokens often found in .env files, notebook cells, and CI/CD logs, as one of the most common findings during reconnaissance since a compromised token can grant access to private models and repositories.
Machine learning pipelines are also flagged as vulnerable to dependency confusion attacks, where internal package names referenced in requirements.txt or environment.yml files are not registered on public registries, leaving an opening for attackers to publish malicious packages under those same names.
What This Means for Defense Organizations
For defense and national security entities, the throughline in Resecurity’s research is architectural: AI systems are built as dense service meshes, with inference servers, vector databases, orchestration tools, and notebooks in constant internal communication.
That design assumes a trusted internal network, which means a single service accidentally bound to a public interface instead of localhost can expose the entire mesh externally.
In defense contexts, where AI systems increasingly touch ISR data, targeting models, and classified or export-controlled training sets, that gap between internal and external exposure is not a theoretical risk.
Resecurity’s advisory recommends organizations treat AI infrastructure as a distinct attack surface requiring dedicated reconnaissance and testing methodology, rather than folding it into conventional web application security assessments.
The firm outlines a phased approach — passive reconnaissance through search engines like Shodan and Censys, active port scanning tailored to AI-specific services, API fingerprinting, metadata extraction, and supply chain review — and offers Vulnerability Assessment and Penetration Testing, Red Teaming, and Managed Threat Detection services to support it.
The full advisory, including a detailed port and protocol reference table and mitigation guidance, is available on Resecurity’s website.
