Hackers Ramp Up Scans for Exposed AI and LLM Infrastructure Over a two-week period, security researchers analyzing Apache and ModSecurity logs from a small web host detected a surge in scans targeting exposed AI-related services, including Model Context Protocol (MCP) servers, AI assistant configuration files, and unauthenticated local large language model (LLM) endpoints. Despite the host lacking any such infrastructure running only low-traffic WordPress sites, custom backends, and static pages attackers persistently probed for vulnerabilities, signaling a growing trend in AI-focused reconnaissance. The scans revealed 200,200,200 requests aimed at AI-agent infrastructure, alongside traditional targets like WordPress XML-RPC, exposed `.env` files, and Git repositories. MCP servers, which enable AI agents to interact with external tools (databases, APIs, cloud services), were a key focus. Unauthenticated access to these servers could allow attackers to enumerate connected resources, abuse server capabilities, or exfiltrate sensitive data. Probes also targeted /sse endpoints, linked to older MCP implementations, suggesting scanners are hunting for both current and legacy deployments. Attackers employed HTTP HEAD requests to check for credential files (e.g., `.claude`, `.cursor`) without downloading them, reducing bandwidth during mass scans. If such files containing API keys, tokens, or internal URLs are accidentally exposed in web-accessible directories, they could grant attackers access to cloud services, internal tools, or LLM inference endpoints. Additionally, unauthenticated LLM servers were probed for free compute resources, model enumeration, or lateral movement opportunities. The scans included Server-Side Request Forgery (SSRF) attempts against Google Cloud metadata services, using parameters like `url`, `uri`, and `dest` to test if applications would fetch attacker-controlled URLs. Successful exploitation could expose cloud service-account tokens, enabling further compromise. While the host in question was not running the targeted services, the findings underscore the expanding attack surface of AI infrastructure. Organizations are advised to enforce authentication for MCP services, restrict public LLM server exposure, block cloud metadata access from fetch endpoints, and prevent AI-related directories from being deployed in web roots. Indicators of compromise (IOCs) include /mcp POST requests (JSON-RPC handshakes) and /sse GET probes, which defenders should monitor and block if unauthenticated.