On Monday, February 2, 2026, the cybersecurity community flagged a notable scanning activity targeting potentially exposed Anthropic models (specifically Claude-compatible API endpoints). This isn't about a massive breach or leaked weights from Anthropic itself, but rather opportunistic probing for misconfigured or publicly accessible local/self-hosted instances that mimic the Anthropic API.
What Happened (Mon, Feb 2nd)
The SANS Internet Storm Center (ISC) reported that a single IP address—204.76.203.210, confirmed as a Tor exit node—began scanning honeypots and sensors. The requests included:
- GET /anthropic/v1/models (to list available models, a standard Anthropic API endpoint)
- Minor upticks in /v1/messages (the core chat/completion endpoint)
These paths match the official Anthropic API structure (e.g., as used by Claude models via their SDK or direct calls). The scans appear to be broad internet-wide discovery efforts, likely automated, hunting for:
- Locally hosted or self-hosted inference servers (e.g., using tools like vLLM, Ollama with custom backends, or reverse-engineered wrappers that expose an Anthropic-compatible API)
- Developer setups, test environments, or production misconfigurations where the endpoint is accidentally exposed to the public internet
- Instances using weak/default auth (e.g., placeholder keys like "password" or no auth at all)
(This screenshot from the SANS diary shows example probe patterns and the Tor-linked source IP.)
Why Tor? Exit nodes are commonly abused for reconnaissance because they obscure the real attacker's origin, making attribution harder while allowing mass scanning without immediate IP blocks.
Why This Matters
Exposed Anthropic-compatible endpoints are attractive targets because:
- Unauthorized access → Anyone could hammer the API for free inference (bypassing Anthropic's rate limits, costs, and safety classifiers)
- Data exfiltration → Prompts, conversation histories, or sensitive context could leak if the instance processes real user data
- Abuse at scale → Criminals could repurpose the endpoint for spam, phishing generation, malware scripting, or other misuse (Anthropic has repeatedly documented Claude being abused for cybercrime in their threat reports)
- Foothold for further attacks → A vulnerable server running inference might have weak isolation, leading to RCE, lateral movement, or crypto-mining
This echoes broader trends: Open-source LLM deployments (including those mimicking proprietary APIs like Anthropic's) have grown massively. Researchers recently highlighted how thousands of exposed open-source LLM instances are vulnerable to takeover or misuse, with real leaked API keys from Anthropic, OpenAI, etc., still popping up in public repos and datasets.
Context and Broader Picture
No evidence points to Anthropic's official cloud-hosted models or APIs being directly compromised here—this is about third-party / self-hosted replicas getting probed. Anthropic has been aggressive on misuse detection (e.g., disrupting AI-orchestrated espionage, vibe hacking for extortion, etc.), but they can't police every unofficial endpoint.
Recent months have seen:
- Leaked keys from scanning GitHub
- Vulnerabilities in tools like Claude Code or MCP servers
- Exposed third-party Claude wrappers (e.g., Clawdbot/Moltbot instances leaking keys and histories)
If you're running anything Anthropic-compatible (even locally for dev), now's a good time to:
- Check exposure via Shodan/Censys or simple port scans
- Enforce authentication (never use defaults)
- Bind to localhost or use strict firewalls/VPCs
- Rotate any leaked keys immediately
The diary is here if you want the full technical write-up: https://isc.sans.edu/diary/32674
Stay vigilant—AI endpoints are becoming the new shadow IT/critical infrastructure targets. If you've spotted similar probes or have thoughts on hardening these setups, share below!