Two years ago, an organisation’s AI exposure was a procurement question: which vendor, which contract, which data residency clause. In 2026 it is an attack surface question, because a meaningful proportion of the AI infrastructure inside Australian organisations was not procured at all. It was installed.
A data scientist stands up a local model server to avoid sending client material to a third party — a genuinely good instinct. A developer runs an inference gateway on a cloud instance to prototype a feature. A team wires an agent framework to an internal document store so it can answer questions about the knowledge base. Each of these is a reasonable act by a competent person. None of them typically involves a change request, and a surprising number end up answering on a public IP address with no authentication in front of them.
What is actually appearing on the perimeter
Security tooling released through 2026 now fingerprints more than sixty distinct model-serving, gateway, MCP and RAG platforms on public endpoints. The categories worth understanding:
Local model servers
Software that runs open-weight models on your own hardware. The value proposition — data never leaves your environment — is real, and is exactly why privacy-conscious teams adopt it. The failure mode is that the environment is not as closed as assumed. An exposed server typically permits anyone to enumerate loaded models, submit arbitrary prompts, and in many configurations pull or delete models entirely.
Inference gateways and proxies
Middleware that routes requests to multiple model providers, handles rate limiting and centralises billing. Because it centralises, it also holds provider API keys. An exposed gateway is a credential store with an HTTP interface, and the resulting bill is a secondary concern next to the fact that a third party is now making requests attributed to your organisation.
MCP servers
The Model Context Protocol became the connective tissue of agentic systems during 2026. An MCP server exposes tools to a model — file access, database queries, ticketing, code repositories, internal APIs. The security property is the important one: an MCP server is, by design, a remote execution surface. Its purpose is to let something else take actions in your environment. If it is reachable without authentication, you have published an action interface to your internal systems.
RAG backends and vector databases
Retrieval-augmented generation requires an index of your documents. That index is a derivative of the source corpus — and an exposed vector store frequently permits similarity queries that reconstruct meaningful portions of the underlying content, without any access control ever being tested. Organisations that carefully classify a document repository routinely give no thought at all to the embedding index built from it.
Why it gets deployed: data never leaves your environment. A genuinely good instinct, and exactly why privacy-conscious teams adopt it.
What an attacker gets: enumerate every loaded model, submit arbitrary prompts at your compute expense, and in many configurations pull or delete models entirely.
Why it is missed: the environment is not as closed as assumed. The failure is not the software — it is the assumption that the instance is private.
Why it gets deployed: it centralises routing across multiple model providers and handles rate limiting and cost attribution.
What an attacker gets: because it centralises, it holds provider API keys. An exposed gateway is a credential store with an HTTP interface.
The real damage: the bill is the secondary concern. The primary one is that a third party is now making model requests attributed to your organisation.
Why it gets deployed: it exposes tools to a model — file access, database queries, ticketing, code repositories, internal APIs.
The security property that matters: an MCP server is, by design, a remote execution surface. Its entire purpose is to let something else take actions in your environment.
What an attacker gets: if it is reachable without authentication, you have published an action interface to your internal systems. Not a data leak — a lateral movement path that an autonomous agent can use exactly as intended.
Why it gets deployed: retrieval-augmented generation requires an index of your documents.
What an attacker gets: an exposed vector store frequently permits similarity queries that reconstruct meaningful portions of the underlying content, without any access control ever being tested.
The governance failure: organisations that carefully classify a document repository routinely give no thought at all to the embedding index built from it. Whatever classification applies to the source applies to the derivative.
Why this surface is being missed
Three structural reasons, and none of them is incompetence.
It falls between two functions. Security teams scan for known application and infrastructure signatures. AI governance functions review model use, bias, explainability and vendor terms. An unauthenticated inference endpoint is neither a traditional application vulnerability nor a model governance question, so it sits in the gap between the two workstreams.
The deployment is fast and the review cycle is not. A model server can be running in ten minutes. Architecture review boards do not convene in ten minutes, and the person who deployed it did not think of it as infrastructure — they thought of it as a tool.
The scanners do not know what they are looking at. Conventional vulnerability tooling has no signature for these platforms. An exposed inference API frequently returns a clean result, because there is nothing to detect against — it is not a vulnerability, it is a working service doing exactly what it was configured to do.
How it maps to obligations you already carry
No new regulation is required to make this a compliance problem. The existing stack covers it:
- CPS 234 — an information asset is an information asset regardless of how novel it is. An undeclared model server holding or indexing regulated data is unclassified and unprotected by definition.
- Essential Eight and the ISM — exposure minimisation and administrative interface restriction apply directly. An open management API on a model server is an unrestricted administrative interface.
- Privacy Act, APP 11 — if personal information reached an unauthenticated endpoint, reasonable steps were not taken. If it reached an embedding index nobody classified, the same conclusion follows.
- ISO/IEC 42001 — an AI management system requires a defined scope. Undiscovered systems are outside scope by accident, which is not a defensible basis for a scoping decision.
The agentic dimension
2026 was the year agentic AI moved from prediction to operational concern — a readership poll of security professionals put agentic and autonomous systems ahead of deepfakes and ransomware as the top anticipated attack vector for the year. The defensive analysis that has held up best makes a specific point about tempo: reconnaissance is now continuous and automatic rather than a discrete pre-attack phase, and a blocked attempt resumes as soon as the agent adapts.
That has a direct implication for exposed AI infrastructure. An endpoint that appears on a Tuesday afternoon during a prototype does not need to survive until the next quarterly scan to be found. Continuous automated discovery means the window between exposure and enumeration is now measured in hours.
It also means the endpoint is not merely a data risk. An exposed MCP server connected to internal tooling is a lateral movement path that an autonomous agent can use as designed — no exploit, no malware, no boundary crossed. The same pattern as June’s enterprise application campaigns, applied to a newer class of system.
What to do, in order
- Discover before you govern. Run a passive external enumeration specifically looking for model-serving, gateway, MCP and vector-store signatures across your perimeter and your cloud address space. You cannot write policy for systems you have not found.
- Ask the question internally, without consequence. A short, explicitly amnesty-framed request to engineering and data teams — “tell us what you have running, nobody is in trouble” — surfaces more in a week than a control review does in a quarter.
- Treat MCP servers as privileged infrastructure. Authentication, network restriction, and an explicit inventory of the tools each server exposes. Anything less publishes an action interface.
- Classify the index, not just the source. Whatever classification applies to a document repository applies to any embedding derived from it.
- Add AI infrastructure to the asset register as a distinct class. Not under “software.” It has a different failure mode and a different owner.
This is a surface almost nobody in the Australian mid-market is currently assessing. That is precisely why it is worth assessing now, while the finding is still cheap to remediate rather than expensive to disclose.