Scanning for exposed Anthropic Models, (Mon, Feb 2nd)
Source SANS ISC Handlers Diary
Description
Yesterday, a single IP address (%%ip:204.76.203.210%%) scanned a number of our sensors for what looks like an anthropic API node. The IP address is known to be a Tor exit node.
Impact
For European organizations, the impact of exposed Anthropic AI model APIs could be multifaceted. Unauthorized access to AI models may lead to leakage of proprietary training data or sensitive information embedded in the models, compromising confidentiality. Attackers could manipulate AI responses, undermining data integrity and trustworthiness of AI-driven decisions. Resource exhaustion attacks could degrade availability of AI services critical to business operations. Given the increasing adoption of AI technologies across sectors such as finance, healthcare, and manufacturing in Europe, exposure of these APIs could have significant operational and reputational consequences. Additionally, compliance with GDPR and other data protection regulations may be jeopardized if personal data processed by AI models is accessed or exfiltrated. The use of Tor exit nodes for scanning complicates attribution and response efforts, increasing the challenge for defenders. Although no active exploitation is reported, the reconnaissance activity signals potential future attacks targeting AI infrastructure, necessitating preemptive security measures.
Defensive guidance
European organizations should implement the following specific mitigations: 1) Conduct comprehensive asset discovery to identify any exposed Anthropic or similar AI model APIs accessible from the internet. 2) Enforce strong authentication mechanisms for all AI model APIs, avoiding default or publicly documented API keys. 3) Implement network segmentation and firewall rules to restrict API access to authorized internal networks or VPNs. 4) Monitor API endpoints for unusual access patterns, including requests from Tor exit nodes or other anonymizing services. 5) Employ rate limiting and anomaly detection on API traffic to detect and block scanning or brute-force attempts. 6) Regularly update and patch AI model hosting platforms and dependencies to address emerging vulnerabilities. 7) Review and minimize data exposure through AI models, ensuring sensitive data is not embedded unnecessarily. 8) Establish incident response plans specific to AI infrastructure, including rapid isolation of compromised APIs. 9) Collaborate with threat intelligence providers to stay informed about emerging AI-related threats and scanning campaigns. 10) Educate development and security teams about secure AI API deployment best practices to prevent inadvertent exposure.
Summary
On February 2, 2026, a single IP address (204.76.203.210), identified as a Tor exit node, was detected scanning multiple sensors for exposed Anthropic API nodes. The scanning involved sending simple HTTP GET requests to the endpoint "/anthropic/v1/models" with a Host header and an X-Api-Key header set to "password," a default key commonly used in documentation but not expected to be valid in production environments. The Anthropic-Version header was also included, indicating the version of the API being targeted. This scanning behavior suggests an attempt to discover locally hosted Anthropic AI models that might be inadvertently exposed to the internet without proper authentication or access controls. In parallel, an increase in requests to the "/v1/messages" endpoint was observed from a different IP address (154.83.103.179), which may also be probing for AI-related APIs, although this endpoint is generic and could belong to other services. No known exploits or successful intrusions have been reported in connection with these scans. The reconnaissance activity is significant because exposed AI model APIs could allow attackers to extract sensitive data, manipulate AI outputs, or consume resources maliciously. The use of a Tor exit node for scanning indicates an attempt to anonymize the source and complicate attribution. While the default API key used in the scan is unlikely to grant access, organizations should not rely on obscurity or default credentials and must ensure robust authentication and network segmentation for AI model APIs. The lack of affected versions or patches suggests this is an emerging reconnaissance trend rather than exploitation of a specific vulnerability. The threat level is currently medium, reflecting the potential risk if exposed Anthropic models exist but no confirmed exploitation.