Future Surveys: AI/ML Infrastructure Categories Not Yet Covered

NuClide Research · 2026-05-04 — last updated 2026-06-02 Companion to: SYNTHESIS-2026-05.md

The 2026-05/06 survey series covers 35+ platform classes. Several adjacent categories remain unsurveyed and are catalogued here as a roadmap. Each entry includes:

• Port(s) to masscan
• Fingerprint (the canonical signature for the probe to use)
• Auth posture in framework default (Tier-A no-auth-concept, Tier-A* auth-optional-off, Tier-B setup-wizard, Tier-C auth-on-default)
• Risk class if exposed
• Status (planned / partial / not-yet)

Anyone running NuClide’s tier-2 cloud range list (/tmp/tier2-all-ranges.txt, Scaleway 7, OVH 33, Linode 36 = 3.55M IPs) can pick a category and run the survey using the same masscan-then-probe pattern documented in the existing case studies.

Priority gaps: still open as of 2026-06-02

Cross-referenced against the 27-category shodan/queries/ index and the completed case-study set. These are the categories with the most untouched surface. Pick from here for a fresh survey:

DCWF KSAT coverage

Auto-derived from DCWF AI work-role rule files (ksat-tag).

• 672 (AI Test & Evaluation Specialist): K7003, K7004, K7044, S7068, S7075, S7076, T5858, T5904
• 733 (AI Risk & Ethics Specialist): K7040, K7051, K7052, S7056, S7067, S7069, T5854, T5868, T5882, T5893, T5904
• overlap (Common AI KSATs (all 5 roles)): K108, K1157, K1158, K1159, K22, K6311, K6900, K6935, K7003, K7024, K7041, K7045, K942, S7065

Detailed port/fingerprint/risk for each is in the per-category sections below.

Compute orchestration / training tier

Most are Tier-A “no auth concept” on the dashboard endpoint. Auth is bolted on by surrounding infra (K8s ingress + auth proxy), not the framework itself.

Embeddings infrastructure

Specialty vector DBs

LLM observability / tracing

Image generation / vision (beyond port 7860 surveyed)

Speech & Audio AI (survey 17: DONE 2026-05-29)

Survey-17 query catalog: shodan/queries/17-voice-audio-ai.md Discovery runbook: data/voice-audio-ai-discovery-runbook.sh aimap fingerprints added (10 new, count went 56 → 66): Whisper ASR, Coqui XTTS, Piper TTS, RVC Voice Cloning WebUI, OpenVoice, ChatTTS, F5-TTS, Pipecat Voice Agent, Vocode Voice Agent, LiveKit Agents.

ML lifecycle / model registries

Agent platforms (newer / autonomy)

Specialty data layers (often AI-adjacent)

Dev-tooling AI / coding agents

Specialty domains

MCP (Model Context Protocol) servers

The newest exposure surface in the AI stack. MCP was designed for stdio (in-process) transport but the ecosystem pushed HTTP/SSE for remote access. Operators wiring filesystem, shell, database, and cloud-API tools into MCP servers and exposing them without auth replays the unauthenticated-RPC failure pattern at the protocol layer.

Existing scaffolding: shodan/queries/10-mcp-servers.md, 8 fingerprint queries already documented. n8n cross-reference (n8n-cloud-survey-2026-05.md) counted ~400 instances exposing MCP endpoints, but no dedicated population-level survey yet.

LLM gateways / OpenAI-compat proxies

Mirror the vLLM-survey reseller-proxy finding (vllm-cloud-survey-2026-05.md documented 10 commercial-API reseller proxies burning operator credit). Different operator tier, gateway products run alongside or in front of upstream LLM providers, exposing provider keys + quota.

RAG framework servers

The pipeline above the vector DBs. RAG framework servers store embedded prompts, retrieval logic, and the bridge between document corpora and LLM calls. Exposing the framework, even with the underlying vector DB locked down, leaks prompt structure, system prompts, and operator data-flow.

AI safety evaluation / red-team self-hosted

Their finding-corpus may itself be sensitive when exposed. Adversarial prompt libraries, evaluator outputs, and red-team test results often contain proprietary attack vectors that operators don’t want public.

Browser automation / agent backends

Headless-Chrome endpoints used by agent stacks. Misconfigured ones offer remote browser control as a service, attackers can drive scraping, credential harvesting, or cloud-resource abuse using the operator’s compute and IP reputation.

Data labeling / annotation servers

Often exposed in ML team workflows; PII frequently in their datasets. Operators stand up labeling tools quickly to crowd-source annotation, then forget to lock them down before walking away.

Population survey DONE 2026-05, see data-labeling-cloud-survey-2026-05.md. Per-platform table below retained for fingerprint reference.

Methodology template

For any platform above, the probe pattern is:

# 1. Masscan the canonical port across the tier-2 cloud /16 ranges
sudo masscan -iL /tmp/tier2-all-ranges.txt -p<port> --rate 10000 --wait 5 -oG /tmp/<platform>-masscan.txt

# 2. Filter to unique IPs
awk '/Host:/ {print $4}' /tmp/<platform>-masscan.txt | sort -u > /tmp/<platform>-ips.txt

# 3. Run the framework-specific fingerprint probe (200-thread Python)
/home/cowboy/security-tools/bin/python3 /tmp/<platform>-probe.py < /tmp/<platform>-ips.txt > /tmp/<platform>-confirmed.jsonl

# 4. Filter AS63949 honeypot fleet pollution if probe is permissive
/home/cowboy/security-tools/bin/python3 /tmp/honeypot-detector.py < /tmp/<platform>-ips.txt | comm -23 /tmp/<platform>-ips.txt -

# 5. Cert-pivot identified hosts on port 443 for operator attribution
while read ip; do
  cn=$(timeout 4 bash -c "echo | openssl s_client -connect $ip:443 -servername $ip 2>/dev/null" | openssl x509 -noout -ext subjectAltName 2>/dev/null | tail -1)
  echo "$ip → $cn"
done < /tmp/<platform>-confirmed-ips.txt

The existing case studies serve as templates, the speech-audio-cloud-survey-2026-05.md is the most recent example following this pattern.

Completed surveys not previously listed here

These categories were surveyed after this doc was last updated (2026-05-04) and were never added to the roadmap. Recorded here for completeness.

Why this list exists

The auth-on-default thesis predicts: for any framework that ships without authentication enabled by default, the population-scale deployment will be unauthenticated. Each unsurveyed platform above is an opportunity to either:

1. Confirm the thesis on a new platform class (extends the evidence base)
2. Falsify the thesis if a platform with auth-off-default ships ~0% unauth at population scale (would be a meaningful counter-example, none observed yet)

The list also acts as a roadmap for any contributor who wants to add coverage. NuClide’s tooling (aimap, recongraph, BARE) already covers many of the fingerprints above; running them at population scale on tier-2 cloud ranges is the work product.

See also

• SYNTHESIS-2026-05.md, completed-survey synthesis
• REMEDIATION-GUIDE.md, operator fix-it guide for the platforms covered
• index.md, index of all completed case studies