- Wiz — the cloud security firm Alphabet agreed to acquire in a roughly $32B deal announced in March 2025 — ran a 90-day honeypot to capture attacker behavior against AI infrastructure such as exposed LLM APIs, GPU compute, vector databases, and ML tooling.
- As of August 28, 2026, the granular attack counts, timelines, and per-service breakdowns from that report could not be independently verified for this analysis, which changes how the findings should be used.
- A honeypot measures exposure, not your risk. The number that matters to a security team is not "how many probes hit the decoy" but "how many of our own endpoints look like that decoy."
- The structural problem is architectural: an internet-reachable inference endpoint is a tool call that anyone on the internet can make, billed to your account.
Ninety Days Is a Measurement Window, Not a Verdict
What does a honeypot actually measure — attacker intent, or internet background radiation? The distinction is not academic, and it is the single most useful thing to hold in mind when reading any "we deployed decoys and watched what happened" study. According to Google News, which surfaced the coverage of this research, Wiz deployed a 90-day honeypot designed to capture real-world attacker telemetry aimed specifically at AI infrastructure: exposed large language model APIs, GPU compute, vector databases, and machine-learning tooling.
Ninety days is 2,160 hours of continuous exposure. That is a genuinely useful window — long enough to distinguish a one-off scanning campaign from a persistent, tooled-up interest in AI services. It is also short enough that a single noisy botnet operator can dominate the dataset. Both things are true at once, and vendor summaries rarely say the second part out loud.
One caveat needs stating up front, because it shapes everything below. As of August 28, 2026, the specific attack counts, service-by-service breakdowns, and time-to-first-probe figures from this report could not be verified independently for this piece. So this is not a recap of numbers. It is an analysis of what that class of research can and cannot tell an engineering team — which is, on balance, the more durable question anyway.
The Pattern: An Exposed Inference Endpoint Is a Tool Call Anyone Can Make
Here is the non-obvious framing that most coverage of AI-infrastructure attacks skips. Security teams tend to file an exposed model server under "misconfigured web service," the same bucket as a public S3 bucket or an open Elasticsearch node. That mental model is wrong in one important way: a public storage bucket leaks data at rest, while a public inference endpoint executes compute on demand and bills you for it.
In agent terms, an unauthenticated LLM endpoint is a tool that has been registered on the open internet with no allowlist. Anyone who finds it gets to invoke it. The attacker does not need a zero-day or a clever prompt injection chain to profit — they need a loop and a script. That is why the threat categories cluster the way the market context describes them: GPU compute gets hijacked for cryptojacking, model weights and training data get exfiltrated, and inference capacity gets resold. Three different motives, one root cause.
And the root cause is depressingly ordinary. The reason AI infrastructure has become a fast-growing attack surface is not that transformers are exotic; it is that LLM APIs, GPU clusters, and ML pipelines are being pushed to the internet quickly, frequently with weak authentication and misconfigured cloud permissions. The novelty is in the payload, not the door.
Which sets up the second-order consequence. Traditional intrusion detection is tuned to spot anomalous access. Abuse of an inference endpoint often looks like perfectly well-formed, fully authorized traffic — just a great deal of it, from somewhere unexpected, at three in the morning. The tell is economic before it is behavioral. The bill moves before the alert fires.
Honeypot Telemetry vs. Your Own Logs: Which Evidence Wins
This is the comparison no single source article makes, and it is where a careful skeptic should push. Suppose a team has budget for exactly one evidence source this quarter. Vendor honeypot research, or an internal effort to instrument and baseline their own AI endpoints? They are not interchangeable.
Honeypot telemetry wins when the question is "what's coming." A decoy captures opportunistic, internet-wide behavior with zero risk to production. It answers questions an internal log cannot: which AI service types are being actively hunted, what tooling attackers have already automated, whether a newly popular framework is on the scanning radar yet. It is a leading indicator, and it is the only practical way to see attacks aimed at things you have not deployed.
Your own logs win when the question is "what's happening to us." A honeypot has no customers, no legitimate baseline, and no business context. Every packet it receives is hostile by definition — which is exactly why it can never tell you which of your traffic is hostile. Internal telemetry, correlated with billing data and identity logs, is the only source that produces an actionable ticket.
The trap is treating the first as a substitute for the second. A published attack count is a headline; a per-endpoint baseline is a control. Teams that read the report, feel appropriately alarmed, and file it under "awareness" have converted research into anxiety rather than into defense. That gap between a compelling statistic and an operational change is the same failure pattern that shows up whenever breach numbers circulate without methodology attached — the tension Smart Cybersecurity examined in its breakdown of why human-error breach stats disagree. Different datasets, same lesson: the number is only as useful as the question it was built to answer.
One more thing worth noting about the source. Wiz publishes threat intelligence as a security vendor, and as of August 28, 2026 it sits inside Alphabet following the roughly $32B acquisition announced in March 2025 — about eighteen months of corporate integration by now. That does not make the research wrong. Honeypot data is comparatively hard to fake and comparatively easy to describe reproducibly. But it does mean the framing of "AI infrastructure is under siege" arrives from a party that sells cloud security posture management, and a reader should weigh the methodology section more heavily than the executive summary. Read the deployment details: what was exposed, for how long, on which providers, and how unique sources were counted.
Implementation: What You'd Actually Wire This Week
Concrete, in the order a backend engineer would tackle them.
Not just the model servers you know about — the demo instance from the hackathon, the Ollama container someone exposed for testing, the vector database that shipped with a default port and no auth. In most organizations this list is longer than the platform team expects. The honeypot's real message is that discovery scanning finds these faster than internal audits do.
Token auth, per-key rate limits, and a hard monthly spend ceiling per key. The spend ceiling is the underrated control: it converts an unbounded cryptojacking or inference-resale incident into a capped, alerting one. Treat it the way a finance team treats a corporate card limit — this is genuinely closer to financial planning than to firewall configuration.
GPU-hour consumption and token throughput per key, with alerts on rate-of-change rather than absolute totals. A legitimate product launch and a hijacked endpoint both spend money; only one of them does it with a flat, machine-regular curve at unusual hours. Wire that alert into the same channel as your paging rotation, because by the time it appears on a monthly invoice the window to act has closed.
Where This Breaks in Production
Every control above has a failure mode, and pretending otherwise is how demos hide their retry logic.
Gateways add latency and become a single point of failure, so teams route "internal" traffic around them — and "internal" quietly becomes "reachable from a VPC that peers with three other VPCs." Spend ceilings get raised during a launch and never lowered. Rate-of-change alerts fire constantly during the first month of any new product, get muted, and stay muted. Meanwhile, agentic systems make baselining genuinely harder: an autonomous agent in a tool-call loop legitimately produces bursty, machine-regular, high-volume traffic that looks statistically similar to abuse. The signature that catches an attacker is the same signature your own retry logic emits at 3 a.m.
That is the honest limit of both the honeypot and the internal baseline. Neither one distinguishes a hostile loop from an expensive one. Only identity and provenance do — which is why per-agent credentials, rather than one shared service key, is the control that actually survives contact with production.
Bottom line: our read is that the durable finding from this class of research is not any single attack count — it is that attacker tooling has already been generalized to AI service fingerprints, which means exposure windows for new AI deployments should be assumed to be measured in hours, not weeks. The more likely trajectory from here is that inference abuse gets treated as a cloud-cost anomaly problem inside FinOps tooling before it gets treated as an intrusion problem inside security tooling, simply because the billing signal arrives first and is easier to measure. Teams that instrument the money as carefully as they instrument the packets will see it coming.
Disclaimer: This article is editorial commentary for informational purposes only and does not constitute financial, legal, or security advice. It reflects analysis of publicly reported information and does not represent independent testing of any product or service. Research based on publicly available sources current as of August 28, 2026.