NewsPublished 15 Apr 2026

Scanning for AI Models, (Tue, Apr 14th)

Source SANS ISC Handlers Diary

Description

Starting March 10, 2026, my DShield sensor started getting probe for various AI models such as claude, openclaw, huggingface, etc. Reviewing the data already reported by other DShield sensors to ISC, the DShield database shows reporting of these probes started that day and has been active ever since.

Impact

The scanning activity could potentially lead to information disclosure if vulnerable AI model deployments expose sensitive files or credentials. However, there are no confirmed exploits or compromises linked to this scanning activity as of the latest reports. The impact is currently limited to reconnaissance and probing, which may precede further targeted attacks if vulnerabilities are found.

Defensive guidance

Organizations should ensure that AI model deployments do not expose sensitive files or credentials publicly and follow best practices for securing AI infrastructure. Monitoring for unusual scanning activity and restricting access to sensitive AI model files can help mitigate potential risks.

Summary

Since March 10, 2026, a unique source IP (81.168.83.103) has been conducting reconnaissance scans targeting AI models and associated files including claude, openclaw, huggingface, and openai. The scans involve HTTP requests looking for specific file paths such as /.openclaw/secrets.json, /.claude/.credentials.json, /.cache/huggingface/token, and /openai/credentials.json. The scanning activity was identified through DShield sensor data aggregated by the SANS Internet Storm Center. The source IP has also scanned various web-related ports since January 29, 2026. No evidence of active exploitation or compromise has been reported, and the scanning appears to be information gathering or reconnaissance.

References

isc.sans.edu/diary/rss/32896 (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 15 Apr 2026, 00:31 UTC

References

Community reviews