Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Someone is scanning your LLM infrastructure right now. They are not waiting for you to finish your security review. Between October 2025 and January 2026, GreyNoise’s honeypot infrastructure captured 91,403 attack sessions targeting exposed LLM endpoints. These were two distinct campaigns systematically mapping the expanding attack surface of misconfigured AI deployments. Your team is moving fast on AI. LLM servers are going live, inference APIs are being connected, MCP endpoints are being spun up.

Most of the work covered in our agentic security operations content assumes one thing: Claude Code is already connected to your LimaCharlie environment. If you haven't done that yet, this is your starting point.

The rise of AI-driven vulnerability discovery using Anthropic's Claude Mythos, as well as similar tools from Google and OpenAI, is completely changing the calculus of cyber risk. The number of vulnerabilities is exploding. The time it takes for exploits to appear is shrinking. The patching cadences and scan intervals, assessments and risk registers that many organizations still rely on are rapidly becoming ineffective.

Every enterprise wants to use AI on its most valuable data — customer records, financial documents, clinical notes, legal files, engineering IP. The problem is simple: the moment that data enters an AI workflow, traditional security stops working. Firewalls protect the network. Encryption protects data at rest. Access controls protect the database. But none of them protect what happens when an AI agent retrieves five documents, synthesizes an answer, and delivers it to a user.