The New Attack Surface Has an API: Measuring Exposed AI Infrastructure

When CISA added three AI and workflow infrastructure components to the KEV catalog in a single September 2026 batch, it marked a shift. The question for defenders is whether their own AI infrastructure is reachable. ZoomEye can help establish the scale of the problem.

The queries

app="LiteLLM"

On the combined dataset, this returned 34,896 records. A free-text search for LiteLLM across all data types returned 47,693 records.
For comparison, the workflow orchestrator Kestra:

app="Kestra"

returned 128 records on the combined dataset, while a free-text search for Kestra returned 270,023 records.
The contrast between those two pairs is instructive. LiteLLM's fingerprint count is high, which suggests the product presents an identifiable interface across many deployments. Kestra's fingerprint count is low while its free-text count is very high, which suggests the string appears widely in page content without the product exposing a distinctive fingerprint.

Geographic distribution

Adding a country facet to the LiteLLM fingerprint query returns a broad distribution:
| Country | Records |
|---|---|
| United States | 7,697 |
| China | 2,060 |
| Japan | 1,928 |
| Australia | 1,782 |
| India | 1,777 |
| Canada | 1,606 |
| Germany | 1,386 |
| France | 1,335 |
| Singapore | 1,331 |
| Indonesia | 1,178 |
The distribution is notably flatter than the Artifactory footprint. No single country dominates, and the top ten span four continents. That pattern is consistent with a technology adopted broadly and quickly by engineering teams rather than concentrated in a particular industry or region.
For Kestra, the fingerprint query returned 128 records with the largest concentrations in the United States (43), China (23), Singapore (17), Germany (12), and the United Kingdom (12).

What the numbers mean and what they do not

A fingerprint match confirms that a service presents an identifiable interface. It does not confirm the version, the configuration, or whether authentication is enforced.
This distinction matters more for AI infrastructure than for most categories. A LiteLLM gateway that is reachable but properly authenticated and patched is not a finding. A gateway that is reachable, unpatched, and storing provider API keys is a serious one. The measurement identifies the population that needs checking; it does not perform the check.
There is also a scope question. AI gateways are frequently deployed on internal networks and exposed only to the applications that consume them. Those deployments will not appear in internet-facing measurements, and their absence from the data is not evidence that they are absent from the organization.

Why AI infrastructure is a distinct category

Three properties separate AI infrastructure from conventional web services.
Credential concentration. A model gateway holds API keys for multiple upstream providers. Those keys carry billing authority and often broader account access.
Data in transit. Prompt and response traffic routinely contains source code, internal documents, and customer data. A gateway compromise is a data exposure event.
Tool invocation. Where MCP servers are involved, the gateway brokers calls to systems that can execute code or query databases. Reaching those endpoints means reaching the tools behind them.
None of these properties is visible in a fingerprint query. What the query provides is the starting point: a way to determine whether the population of exposed instances is large enough to warrant a systematic inventory effort.
At 34,896 fingerprint matches for a single AI gateway product, the answer is yes.

A practical sequence

1. Query the product fingerprints relevant to your stack.
2. Add country and organization facets to identify where exposure concentrates.
3. Reconcile against your own inventory, paying attention to instances you did not know existed.
4. Confirm version and authentication configuration separately, since fingerprints do not reveal either.
5. Re-run the queries after remediation to verify the change.

References

• ZoomEye, fingerprint query app="LiteLLM", combined dataset, collected 2026-09-20. Total: 34,896 records, with country facet distribution.
• ZoomEye, free-text query LiteLLM, combined dataset, collected 2026-09-20. Total: 47,693 records.
• ZoomEye, fingerprint query app="Kestra", combined dataset, collected 2026-09-20. Total: 128 records, with country facet distribution.
• ZoomEye, free-text query Kestra, combined dataset, collected 2026-09-20. Total: 270,023 records.
• CISA, Known Exploited Vulnerabilities Catalog, additions dated September 2, 2026. https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• NVD, CVE-2026-59822. https://nvd.nist.gov/vuln/detail/CVE-2026-59822