Accessing Models Directly Through AJAX
Yes this raises concerns

You'll be skipping some controller logic which may involve;


Checking certain user conditions (ie: are they logged-in)
Can they perform this model action due to their ACL/permissions?
Collecting other data from other models/methods to pass into this model method


Depending on your design, accessing a model directly and skipping the controller logic can raise some unexpected errors (described above) and/or give users actions they wouldn't necessarily have. i.e: Admin@RemoveUser

Usually in an MVC pattern, the model and method names are guessable, depending on the action. Ie: http://example.com/user/view/1 = User model, viewAction method. So exposing this information isn't really a concern. What is a concern is users accessing model action that are restricted by controller logic.

So, what should I do?

Contact the controller directly, and have your view processor to detect it's an AJAX request (through the HTTP_X_REQUESTED_WITH=XMLHttpRequest header) to "disable" the default view with all the design, and just passback (usually) a JSON string that you can use with JavaScript (JSON.parse) and do as you want with the result.