ai_osint - 🤖 Curated AI OSINT resources — Google dorks, Shoda

项目说明

<p align="center">
<img src="assets/logo.png" alt="AI OSINT" width="400">
</p>

<h1 align="center">AI OSINT</h1>

<p align="center">
<b>Curated OSINT resources for disco exposed AI infrastructure — dorks, queries, tools, and techniques for LLM, AI agent, and ML pipeline reconnaissance.</b>
</p>

<p align="center">
<a href="LICENSE"><img src=" alt="MIT"></a>
<a href=" src=" alt="CC BY-SA 4.0"></a>
<img src=" alt="Updated">
<a href="CONTRIBUTING.md"><img src=" alt="PRs"></a>
<img src=" alt="Stars">
</p>

<p align="center">
<code>187,000+ Ollama servers exposed</code> · <code>370,000+ Grok con indexed</code> · <code>AI credential leaks up 81% YoY</code> · <code>150M+ MCP downloads affected by systemic RCE</code> · <code>300K+ ChatGPT creds on dark web</code>
</p>

---

> AI OSINT is a curated collection of Google dorks, Shodan queries, GitHub dorks, Censys queries, Sigma detection rules, threat intelligence, and security tools for finding exposed artificial intelligence infrastructure on the internet. It covers LLM endpoints (Ollama, vLLM, LM Studio), AI chatbot con leaks (ChatGPT, Grok, Perplexity), databases (Qdrant, Weaviate, ChromaDB, Milvus, Pinecone), AI agent gateways (OpenClaw, MCP servers), MLOps platforms (MLflow, Jupyter, Kubeflow), leaked AI API keys (OpenAI, Anthropic, Google Gemini, HuggingFace, Groq, Replicate, Cohere, Mistral, DeepSeek, Ele), and AI image generation services (Stable Diffusion, ComfyUI). Designed for Red Team operators, penetration testers, bug bounty hunters, and OSINT researchers working in AI/ML security.

It now also covers MCP supply chain attacks (systemic STDIO RCE, marketplace poisoning), AI IDE exploitation (Copilot YOLO mode, Windsurf zero-click), AI model leak incidents (Claude Code source map, DeepSeek ClickHouse exposure), AI-assisted discovery (Mythos/Glasswing), and ChatGPT data exfiltration techniques.

---

Why This Exists

Organizations are deploying LLMs, databases, and AI agents faster than they can secure them. The result:

This repository gives Red Team operators and OSINT professionals the exact queries to find it all.

Inspired by: 7WaySecurity/cloud_osint

---

🔑 The KEYWORD Con — Read This First

As of v1.3.0, every dork and query in this repository uses a KEYWORD placeholder in place of the secret-seeking value strings (passwords, tokens, credentials, etc.) that used to be hard-coded.

Replace KEYWORD with a term you are authorized to search for:

What stays: service fingerprints (product titles, API paths, ports, env- like OPENAI_API_KEY, key prefixes like sk-proj-) are kept as-is — they identify the *service or format*, not a specific 's secret.

Why: documenting *that* a class of system is commonly misconfigured, and *how* to check your own exposure, is legitimate defensive and red-team work. Shipping copy-paste queries whose only function is to maximize the yield of *other people's* li is not. The KEYWORD con keeps every technique here useful for authorized testing without being a turnkey har kit.

If a hit surfaces a third party's secret, that is not your finding to act on — report it responsibly and move on.

---

📋 Table of Contents

| Section | What You'll Find |
|---|---|
| Google Dorks | Queries for ChatGPT, Grok, HuggingFace, dashboards, config files |
| GitHub Dorks | Leaked API keys for 20+ AI pro, MCP configs, system prompts |
| Shodan Queries | Ollama, vLLM, OpenClaw, Gradio, DBs, MLflow, Jupyter |
| Censys Queries | Alternati queries for all AI services |
| AI Service Endpoints | URL patterns, default ports, API fingerprinting |
| API Key Patterns | Prefixes, regex, for every major AI provider |
| DB Recon | Endpoints to enumerate Qdrant, Weaviate, ChromaDB, Milvus |
| MCP & Agent Exposure | The most critical emerging attack surface in AI security |
| Threat Intelligence | Operation Bizarre Bazaar, Clawdbot crisis, MCP supply chain |
| Tools | AI-specific only — scanners, red team frameworks, key detectors |
| Detection Rules | Sigma rules for monitoring AI infrastructure |

---

🔍 Google Dorks

> Full collection: dorks/google/

Exposed AI Con & Credentials

Exposed AI Dashboards

AI Config & Credential Files

MCP Ser Exposure (v1.2.0)

---

🐙 GitHub Dorks

> Full collection: dorks/github/
>
> ⚠️ Syntax note: GitHub migrated to new Code Search. Use path:*.env instead of legacy filename:.env. Queries below use modern syntax where applicable.

AI API Keys on GitHub

MCP & Agent Config Leaks

System Prompts & Training Data

MCP & AI IDE Config Exploitation (v1.2.0)

---

🔭 Shodan Queries

> Full collection: dorks/shodan/

Self-Hosted LLMs

AI Agent Gateways — CRITICAL

Gradio & Streamlit Apps

Databases

MLOps & Notebooks

MCP & AI Agent Gateways (v1.2.0)

---

🌐 Censys Queries

> Full collection: dorks/censys/

---

🌍 AI Service Endpoints

Major Provider APIs

| Provider | API Endpoint | Shared Content |
|---|---|---|
| OpenAI | api.openai.com/v1/* | chatgpt.com/share/* |
| Anthropic | api.anthropic.com/v1/* | — |
| Google | generati.googleapis.com//* | — |
| xAI | api.x.ai/v1/* | grok.com/share/* |
| Mistral | api.mistral.ai/v1/* | — |
| Cohere | api.cohere.ai/v1/* | — |
| DeepSeek | api.deepseek.com/v1/* | — |
| Groq | api.groq.com/openai/v1/* | — |
| HuggingFace | api-inference.huggingface.co/models/* | huggingface.co/spaces/* |
| Ele | api.ele.io/v1/* | — |

Default Ports (all against official docs)

| Service | Port | Auth Default | Risk Level |
|---|---|---|---|
| Ollama | 11434 | ❌ None | 🔴 Critical |
| vLLM | 8000 | ❌ None | 🔴 Critical |
| OpenClaw | 18789 | ❌ None (fixed in rebrand) | 🔴 Critical |
| Gradio | 7860 | ❌ None | 🔴 Critical |
| Streamlit | 8501 | ❌ None | 🟡 High |
| MLflow | 5000 | ❌ None | 🔴 Critical |
| Qdrant | 6333/6334 | ❌ None | 🔴 Critical |
| Weaviate | 8080 (+ gRPC 50051) | ❌ None | 🟡 High |
| ChromaDB | 8000 | ❌ None (binds localhost) | 🟡 High |
| Milvus | 19530 (+ mgmt 9091) | ❌ None | 🟡 High |
| Jupyter | 8888 | ✅ Token (often disabled) | 🟡 High |
| LM Studio | 1234 | ❌ None | 🟡 High |
| GPT4All | 4891 | ❌ None | 🟡 High |
| Flowise | 3000 | ❌ None | 🔴 Critical |
| LiteLLM Proxy | 4000 | ❌ None | 🔴 Critical |
| Open WebUI | 3000/8080 | ✅ Auth (default) | 🟡 High |
| nginx-ui | 443/9000 | ✅ Auth (bypassable) | 🔴 Critical |
| ClickHouse | 8123/9000 | ❌ None | 🔴 Critical |
| TGI (HuggingFace) | 8080 | ❌ None | 🟡 High |
---

🔑 API Key Patterns

Prefix Reference ( against official docs)

| Provider | Prefix | Length | Notes |
|---|---|---|---|
| OpenAI | sk-proj- | ~80+ chars | Current format since April 2024 |
| Anthropic | sk-ant-api03- | ~90+ chars | API keys |
| Anthropic OAuth | sk-ant-oat01- | — | OAuth tokens (Files API, etc.) |
| Google AI | AIzaSy | 39 chars | ⚠️ Same prefix for Maps AND Gemini |
| HuggingFace | hf_ | ~34 chars | Read/write access tokens |
| Replicate | r8_ | ~40 chars | — |
| Groq | gsk_ | ~52 chars | — |

Regex for Detection

> ⚠️ Google AIzaSy warning: Google uses the same prefix for ALL Cloud APIs. A Maps API key embedded in public Ja can silently gain Gemini API access if the Generati API is enabled on the same project. This was documented as a significant issue in early 2026.

---

🗃️ Database Reconnaissance

When exposed, databases leak proprietary embeddings, sensiti, and internal knowledge bases used in RAG systems.

Enumeration Endpoints ( against official API docs)

| Database | List Collections | Extract Data |
|---|---|---|
| Qdrant | GET /collections | POST /collections/{name}/points/scroll |
| Weaviate | GET /v1/schema | GET /v1/objects?class={name} |
| ChromaDB | GET /api/v2/collections ⚠️ | POST /api/v2/collections/{id}/query |
| Milvus | gRPC ListCollections | gRPC Search/Query |

> ⚠️ ChromaDB API update: v1.0.0+ migrated to /api/v2. The legacy /api/v1/collections now returns a deprecation error. Update your recon scripts accordingly.

---

🤖 MCP & AI Agent Exposure

The Model Context Protocol (MCP) is the most critical emerging attack surface in AI security (2025-2026).

Why MCP is Dangerous

MCP servers connect AI models to shell access, file systems, databases, and APIs. Misconfigurations expose:

Discovery Queries

Key Incidents

| Incident | Date | Impact |
|---|---|---|
| OpenClaw Shodan Exposure | Jan 2026 | 4,000+ agent gateways, many with zero auth and RCE |
| Operation Bizarre Bazaar | Dec 2025–Jan 2026 | 35,000 attacks on LLM/MCP endpoints; commercial resale |
| Smithery Registry Breach | 2025 | Fly.io token → control of 3,000+ MCP servers |
| mcp-remote C | 2025 | Command injection in 437K+ installs |
| Cursor IDE MCP Trust Issue | 2025 | Persistent RCE repo configs (CVSS 7.2-8.8) |
| MCP Systemic RCE (Ox Security) | Apr 2026 | 150M+ downloads, 200K servers, 10+ CVEs, 9/11 marketplaces poisoned |
| nginx-ui MCPwn (C) | Mar 2026 | CVSS 9.8, actively exploited, full Nginx takeover in 2 requests |
| Atlassian MCPwnfluence | Apr 2026 | C/27826 — RCE chain from LAN, no auth required |
| MCP TypeScript SDK Data Leak | Apr 2026 | C — cross-client data leak in shared McpSer |
| Windsurf Zero-Click RCE | Apr 2026 | C — zero-click prompt injection → local RCE via MCP |

> 📖 Full timeline: threat-intel/THREAT_INTELLIGENCE.md

---

📊 Threat Intelligence

> Full entries: threat-intel/

---

🛠️ Tools

> Only AI-specific tools. Full details: tools/TOOLS.md
> For generic OSINT tools (Shodan, Censys, etc.) see cloud_osint.

| Tool | What It Does | By |
|---|---|---|
| Garak | LLM scanner — "nmap for LLMs" | NVIDIA |
| PyRIT | AI red teaming framework — Crescendo, jailbreaking, multi-turn | Microsoft |
| promptfoo | LLM pentesting CLI — 133+ attack plugins | OpenAI |
| DeepTeam | 50+ vulns, 20+ attacks, OWASP/MITRE mapping | Confident AI |
| API Radar | Real-time leaked AI API key monitoring on GitHub | Independent |
| KeyLeak Detector | Web scanner for 200+ patterns incl. 15+ AI pro | Independent |
| promptmap | ChatGPT dorks & prompt injection testing | Utku Şen |
| MCP | MCP database with CVEs and PoCs | Community |
| MCPSafetyScanner | MCP ser auditing tool | Academic (Leidos) |
| Cisco AI Supply Chain Scanners | Scanners for MCP, A2A, pickle files, agentic skill files | Cisco Talos |
| DorkEye | Automated Google Dorking with multi-agent analysis pipeline | Open Source |

---

🚨 Detection Rules

> Full Sigma rules: detection-rules/SIGMA_RULES.md

12 Sigma detection rules co:

---

📚 References

Research

| Source | Finding | Link |
|---|---|---|
| SentinelOne + Censys | 175,108 exposed Ollama hosts across 130 countries | SecurityWeek |
| Cisco Talos | 1,100+ Ollama servers, 20% serving models without auth | Cisco Blog |
| Pillar Security | Operation Bizarre Bazaar: 35,000 LLMjacking attacks | Pillar Security |
| GitGuardian | AI credential leaks surged 81% YoY; 29M secrets on GitHub | Report |
| AuthZed | Complete MCP security breaches timeline | Blog |
| Pangea | Sensitive data in indexed ChatGPT histories | Blog |
| Trail of Bits | 8 high-se vulns in Gradio 5 audit | Blog |
| Oasis Security | "Claudy Day" — 3 vulns chained for data exfiltration from Claude | Blog |
| Forbes | ~600 Claude con indexed by Google | Article |
| Obsidian Security | 143K+ LLM chats (incl. Claude) on Archive.org | Blog |
| TechRadar | Claude Code 512K source lines leaked via npm | Article |
| Penligent | Claude Code source map leak analysis | Blog |
| Ox Security | 150M+ MCP downloads affected by systemic RCE, 10+ CVEs, 9/11 marketplaces poisoned | Blog |
| Anthropic Red Team | Claude Mythos: thousands of 0-days, C, sandbox escape | red.anthropic.com |
| IBM X-Force | 300K+ ChatGPT creds on dark web, supply chain attacks 4x in 5 years | Report |
| Check Point | ChatGPT DNS exfiltration — silent data leakage via side channel | Blog |
| Zscaler ThreatLabz | Claude Code source leak + Vidar/GhostSocks malware lure | Blog |
| Cisco AI | State of AI Security 2026 — MCP, A2A, agentic AI scanners | Report |
| LeakIX | 12,269 additional exposed Ollama instances, auth PR rejection critique | Blog |
| CSA | Time-to-exploit now under 20 hours (Mythos briefing) | HelpNetSecurity |
| Wiz | Claude Mythos practical guidance — "Y2K moment" for cybersecurity | Blog |
| Wiz | DeepSeek ClickHouse exposure — 1M+ log entries with plaintext chats | Blog |

Standards

---

⚠️ Disclaimer

The resources in this repository are for authorized security testing, education, and legitimate research only.

1. Obtain proper authorization before testing infrastructure you do not own
2. Follow applicable laws (CFAA, GDPR, local equi)
3. Report responsibly through appropriate disclosure channels
4. Ne discovered misconfigurations for unauthorized access

The authors assume no liability for misuse.

---

🤝 Contributing

PRs welcome! Please dorks/queries work before submitting. See CONTRIBUTING.md.

---

License

Code: MIT · Data & Documentation: CC BY-SA 4.0

---

<p align="center"><b>Maintained by <a href=" · Last updated June 2026 · v1.4.0</p>

项目信息

开发语言：未知

Star 数：166

技术要点

该项目属于红蓝攻防方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕🤖 Curated AI OSINT resources — Google dorks, Shodan queries, GitHub dorks, and techniques to discover exposed LLM endpoints, leaked AI API keys, misconfigured vector databases, and unprotected AI agents展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。