Security researchers have reported that residential proxy software was operating from internet addresses assigned to the Executive Office of the President, potentially allowing paying customers to route traffic through the White House network. The activity was observed repeatedly from early October through early November, according to findings reported by KrebsOnSecurity.

Layer3 Intel said it identified proxy nodes communicating from AS2650, the network reserved for the executive office. Its review recorded 236 proxy exits between October 5 and November 3. The researchers said six addresses were involved across 26 of the 30 days studied, with most activity occurring between 5 p.m. and midnight.

Residential proxy networks work by using computers or mobile devices as relays. A customer’s request emerges from the relay’s internet address, masking the customer’s actual location and making the traffic appear to come from a home, workplace or other trusted network. Some applications incorporate proxy software-development kits as a way to earn money from installations, and users may not understand that their connection is being resold.

Proxy-tracking company Synthient associated some of the White House traffic with Windows 11 systems running Infatica, software frequently bundled into free desktop or mobile applications. Layer3 Intel reported a wider exposure: it said 28 residential proxy services could send traffic through the network. The company said it discovered the addresses through ordinary rotating access rather than by deliberately targeting the White House.

The observations do not establish who installed the software or whether the affected devices were government-owned, personally owned or otherwise connected to the network. The White House had not responded to the publication’s request for comment at the time of the report. Those uncertainties are important because an internet address alone does not identify an individual user or prove that a core government system was compromised.

Even so, an open proxy on a sensitive network creates material risk. Customers can use a rented address to conceal scraping, advertising fraud, account attacks or other unwanted activity. Vulnerable proxy software can also expose nearby systems if attackers are able to probe the local network from a compromised endpoint.

The problem is not limited to government. Previous industry surveys cited in the report found residential proxies across hundreds of government, utility, healthcare and financial networks. That prevalence reflects a difficult security challenge: software installed on an employee device can turn a legitimate connection into externally rented infrastructure without producing an obvious outage.

For organizations, the reported White House activity underscores the need to restrict unapproved software, monitor connections to known proxy domains and separate personal devices from sensitive networks. The immediate finding is an exposure report, not proof of a breach, but the persistence and number of services observed make it more than an isolated connection.