NewsPublished 11 Sep 2026

The Self-Expanding Stolen Inference Supply Chain: An AI Agent Harvesting and Re-Serving LLM Access, (Fri, Sep 11th)

Source SANS ISC Handlers Diary

Description

An attacker operates a semi-autonomous coding agent that identifies poorly secured large language model (LLM) resale gateways, acquires API access through common web vulnerabilities and account farming, validates the inference capacity, and aggregates it behind a single unified gateway. This creates a partially self-expanding supply chain of stolen inference capacity, where the agent continuously harvests and consolidates LLM access to support further operations. The attacker’s infrastructure includes hundreds of compromised endpoints mapped to standard model names, served through a single proxy with failover and load balancing. The operation was uncovered through an AI honeypot that captured the agent’s operational playbook and infrastructure details.

Impact

The attacker gains unauthorized access to large numbers of LLM inference endpoints, effectively stealing inference capacity rather than just credentials. This enables the attacker to resell or reuse stolen LLM access at scale, potentially impacting the availability and billing of legitimate LLM service providers. The aggregation of compromised endpoints behind a single gateway amplifies the scale and efficiency of the abuse. The operation also exposes the risk of sensitive operational data leakage when interacting with untrusted LLM endpoints. There is no indication of direct data breach or code execution on victim infrastructure, but the unauthorized use of inference resources constitutes a significant service abuse and supply chain risk.

Defensive guidance

Operators of LLM gateways should audit and remediate common weaknesses such as open registration with free balances, default or weak credentials, authorization decisions based on client-supplied fields (e.g., group_id), exposed account management APIs, unauthenticated model or account information endpoints, and excessive default billing limits. Continuous automated scanning by AI agents should be assumed. Users of third-party or free LLM proxies should be cautious about the operational context their agents send upstream, as it may leak sensitive information. Treat untrusted LLM endpoints as potential data exfiltration points. Patch or secure all identified vulnerabilities in LLM resale infrastructure to prevent unauthorized access and aggregation.

Summary

The threat involves a semi-autonomous offensive agent that searches for vulnerable LLM resale gateways using reconnaissance queries, exploits web flaws such as open registration, default credentials, and authorization weaknesses to acquire API keys, and validates these keys by testing inference responses. The agent aggregates hundreds of valid LLM endpoints into a single self-hosted API gateway, enabling prioritized, failover-enabled access to stolen inference capacity. The operation includes direct database manipulation to bypass rate limits. This creates a feedback loop where the agent’s output supports further credential harvesting and inference aggregation. The captured data revealed detailed operational instructions, infrastructure notes, and the attacker’s direct IP address. The attack highlights risks in poorly secured LLM resale services and the potential for automated, continuous exploitation by AI agents.

References

isc.sans.edu/diary/rss/33332 (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 11 Sep 2026, 14:47 UTC

References

Community reviews

Related threats