Attack Agent Funnels 379 Stolen LLM Upstreams Into a Single Gateway, Creating a Self-Reinforcing Inference Supply Chain

SANS Internet Storm Center researcher Renato Marinho published honeypot logs on September 11 showing that an attacker’s software agent mistakenly treated a honeypot emulating the OpenAI API as a free model backend. Because the client sent its system instructions and session context along with each request, the researcher captured about 43 KB of data in a single incident, including `AGENTS.md`, an attack playbook, reconnaissance scripts, collected keys, and portions of the agent’s history.

The workflow first used FOFA queries to find LLM resale infrastructure such as V2Board, then attempted to exploit open registration, default passwords, authorization flaws that trusted client-supplied `group_id` values, and exposed account endpoints. Trial accounts could also be created in bulk using temporary email and CAPTCHA services. After obtaining keys, the agent called the upstream services and used simple factorial questions to filter out endpoints that returned canned responses or no longer worked. The researcher observed the attacker importing about 379 upstreams into a self-hosted New API gateway. Of these, 341 were disabled after failing tests, while the remaining channels were mapped to five standardized model names and configured with priority-based round-robin routing and automatic failover. The model names came solely from reseller claims and do not prove that the backends actually served the models advertised.

The feedback loop is the most notable aspect: the agent acquired new inference credits, wrapped them behind a unified interface, and could then use them to support subsequent operations. This extends the LLMjacking activity previously documented by Sysdig—from simply stealing cloud credits to turning stolen compute into both an attack tool and a resale supply. The evidence still represents only a single honeypot observation, and humans continued to provide direction, so it does not justify describing the system as autonomously self-replicating.

Engineering teams should treat model gateways like databases or payment APIs: disable default credits for public registration, never use client-supplied group or pricing fields as the basis for authorization, restrict access to model-catalog and account endpoints, rotate keys suspected of exposure, and detect mass registrations, probing across many upstreams, and anomalous low-cost validation requests. Developers using inexpensive proxies should also assume that their complete code, tool outputs, and agent state may be sent upstream.