Hackers are going after top LLM services by cracking misconfigured proxies

• GreyNoise logged 91,000 attack sessions against exposed AI systems between Oct 2025 and Jan 2026
• Campaigns included tricking servers into “phoning home” and mass probing to map AI models
• Malicious actors targeted misconfigured proxies, testing OpenAI, Gemini, and other LLM APIs at scale

Hackers are targeting misconfigured proxies in order to see if they can break into the underlying Large Language Model (LLM) service, experts have warned.

Researchers at GreyNoise recently set up a fake, exposed AI system to see who would try to interact with it.

Between October 2025, and January 2026, they logged more than 91,000 attack sessions which exposed two attack campaigns.