Unsecured AI inference endpoints are giving threat actors ready-made infrastructure for offensive operations, no credentials required.
Summary
- Attackers are locating and hijacking exposed AI endpoints that require no authentication to access.
- Compromised endpoints are being used to power offensive operations, effectively turning victims’ own AI infrastructure against others.
- Exposure stems from endpoints being reachable on the public internet without access controls in place.
- Organisations running AI workloads need to audit what endpoints are externally accessible and enforce authentication as a baseline control.
- The attack path is straightforward: discovery plus access equals exploitation, with no sophisticated credential theft required.
The Problem Is Visibility, Not Sophistication
The threat described here does not require an attacker to be especially skilled. It requires them to know where to look. Exposed AI endpoints — inference APIs and similar services left reachable on the public internet without authentication controls — are being located by threat actors and turned to offensive purposes. The barrier to entry is low: find the endpoint, reach it, use it.
No Credentials, No Problem
What makes this category of exposure particularly concerning is the absence of any authentication requirement on the target endpoint. Conventional attack chains often depend on credential theft, phishing, or privilege escalation. Here, none of that is necessary. If an AI endpoint is publicly reachable and unprotected, an attacker can interact with it directly. The organisation running the workload may have no immediate visibility into the fact that their infrastructure is being used for purposes they never intended.
Offensive Use of Hijacked Capacity
According to the reporting from Dark Reading, attackers are not simply probing these endpoints out of curiosity. They are actively using them to support offensive operations. The compute and model access that organisations have provisioned for legitimate AI workloads becomes, in effect, a resource pool for threat actors. The implications extend beyond the cost of unauthorised compute consumption: the organisation’s infrastructure becomes a participant in activity it has no control over.
How Endpoints Become Exposed
The root cause is a familiar one in cloud and internet-facing deployments: services are stood up, sometimes quickly, and network-level access controls or authentication layers are not applied consistently. AI workloads, including model serving infrastructure, are not inherently different from any other internet-facing service in this respect. The difference is that the value of what sits behind an unprotected AI endpoint — both in terms of compute cost and potential for misuse — can be significant.
Discovery Is the Only Prerequisite
Threat actors locating exposed endpoints are likely using the same internet scanning and enumeration techniques that security teams use during penetration testing and attack surface assessments. Services such as Shodan and similar tools make it straightforward to identify internet-facing infrastructure by port, banner, or service type. AI inference endpoints that are left open are, in that sense, discoverable by anyone motivated to look.
A Growing Attack Surface
Organisations are deploying AI workloads at pace. Development teams experimenting with model serving, internal tooling built on top of open-source inference frameworks, and production deployments that have been misconfigured all contribute to an expanding attack surface. Security teams that have not specifically inventoried AI-related infrastructure may be unaware of what is externally reachable. This is not a hypothetical gap — it is the kind of gap that the behaviour described in the Dark Reading report actively exploits.
Why it matters
For CISOs, this is an asset visibility and access control problem applied to a relatively new category of workload. AI endpoints carry the same fundamental security requirements as any other internet-facing service, but the speed at which AI infrastructure is being deployed often outpaces the security review cycles that would catch missing authentication or overly permissive network access. The consequence is not only the potential for reputational and compliance exposure — it is that your organisation’s infrastructure and associated costs can be turned to uses entirely outside your control. If your team has not conducted a specific review of which AI-related endpoints are externally reachable, that review is now overdue.
What to do now
- Conduct an inventory of all AI inference endpoints and model-serving infrastructure to determine which are reachable from the public internet.
- Enforce authentication on every externally accessible AI endpoint as a non-negotiable baseline control.
- Apply network-level access restrictions — such as allowlisting known IP ranges — wherever possible to reduce the exposure surface.
- Include AI workloads and inference infrastructure in regular attack surface assessments and internet-facing service reviews.
- Establish monitoring for unusual usage patterns on AI endpoints, including unexpected traffic volumes or access from unfamiliar sources, to detect potential hijacking.
