The threat involves a semi-autonomous offensive agent that searches for vulnerable LLM resale gateways using reconnaissance queries, exploits web flaws such as open registration, default credentials, and authorization weaknesses to acquire API keys, and validates these keys by testing inference responses. The agent aggregates hundreds of valid LLM endpoints into a single self-hosted API gateway, enabling prioritized, failover-enabled access to stolen inference capacity. The operation includes direct database manipulation to bypass rate limits. This creates a feedback loop where the agent’s output supports further credential harvesting and inference aggregation. The captured data revealed detailed operational instructions, infrastructure notes, and the attacker’s direct IP address. The attack highlights risks in poorly secured LLM resale services and the potential for automated, continuous exploitation by AI agents.

The attacker gains unauthorized access to large numbers of LLM inference endpoints, effectively stealing inference capacity rather than just credentials. This enables the attacker to resell or reuse stolen LLM access at scale, potentially impacting the availability and billing of legitimate LLM service providers. The aggregation of compromised endpoints behind a single gateway amplifies the scale and efficiency of the abuse. The operation also exposes the risk of sensitive operational data leakage when interacting with untrusted LLM endpoints. There is no indication of direct data breach or code execution on victim infrastructure, but the unauthorized use of inference resources constitutes a significant service abuse and supply chain risk.

Operators of LLM gateways should audit and remediate common weaknesses such as open registration with free balances, default or weak credentials, authorization decisions based on client-supplied fields (e.g., group_id), exposed account management APIs, unauthenticated model or account information endpoints, and excessive default billing limits. Continuous automated scanning by AI agents should be assumed. Users of third-party or free LLM proxies should be cautious about the operational context their agents send upstream, as it may leak sensitive information. Treat untrusted LLM endpoints as potential data exfiltration points. Patch or secure all identified vulnerabilities in LLM resale infrastructure to prevent unauthorized access and aggregation.