Threat actors have been performing LLM reconnaissance, probing proxy misconfigurations that leak access to commercial APIs.