Active Scanning

Adversaries may actively scan for publicly reachable AI systems and resources for targeting. They may identify resources or systems that are misconfigured or are known vulnerable versions. This is distinct from other reconnaissance techniques that do not involve direct interaction with the victim system.

Since AI systems are often deployed in cloud environments, adversaries can use various enumeration methods to effectively discover AI systems and uncover information about their supporting underlying platforms. For agentic and SaaS-hosted systems, the victim system can include the shared platform and provider control plane on which the victim's agents are deployed.

Adversaries may probe the victim system to gather information and metadata for targeting, or actively scan for specific open ports on a potential victim's network or accessible deployed servers, with the goal of locating different types of deployed AI services. These methods could also include directly scanning a target's assets for publicly available AI agents, or for accessible agentic chat interfaces on SaaS platforms (ex: Copilot Studio Hunter).

Information gained from Active Scanning may yield targets that provide opportunities for other forms of reconnaissance such as Search Open Technical Databases, Search Open Websites/Domains, Search Open AI Vulnerability Analysis, or Gather RAG-Indexed Targets.