Loading story…
Researchers reported that third-party API routers used in LLM agent tool-calling can act as a supply-chain attack point because they can inspect and modify plaintext JSON exchanged between clients and upstream model providers. In a study of 28 paid routers and 400 free routers sourced from online marketplaces and public communities, 1 paid router and 8 free routers were found actively injecting malicious code, while 2 routers used adaptive evasion techniques such as dependency-targeted injection and conditional delivery to avoid detection.
The testing also showed direct secret exposure and financial impact. 17 routers interacted with researcher-planted AWS canary credentials, and 1 router used a researcher-controlled private key to drain ETH. Follow-on poisoning experiments found that even routers that initially appeared benign could become dangerous, including one leaked OpenAI key that generated 100 million GPT-5.4 tokens and more than seven Codex sessions; weaker decoys led to 2 billion billed tokens, exposure of 99 credentials, and 440 Codex sessions, with 401 already running in autonomous YOLO mode. The authors built a research proxy called Mine to reproduce payload-injection and secret-exfiltration attacks and evaluated defenses including fail-closed policy gating, anomaly screening, and append-only transparency logging.
Track how attackers are adapting to this technology.
7 events from the most recent confirmed update back to the earliest known activity.
The research was publicly disclosed in the paper 'Your Agent Is Mine: Measuring Malicious Intermediary Attacks on the LLM Supply Chain,' detailing the threat model, empirical findings, and proposed defenses for malicious LLM API routers.
To study and reproduce intermediary attacks, the authors built a research proxy called Mine and tested mitigations including fail-closed policy gating, response-side anomaly screening, and append-only transparency logging across public agent frameworks.
Additional poisoning studies showed that seemingly benign routers could become dangerous, including one leaked OpenAI key that generated 100 million GPT-5.4 tokens and more than seven Codex sessions; weaker decoys led to 2 billion billed tokens and exposure of 99 credentials across 440 Codex sessions.
During the evaluation, one router used access to a researcher-controlled private key to steal ETH, providing a concrete example of financial theft enabled by malicious LLM intermediaries.
Researchers found that 1 paid router and 8 free routers actively injected malicious code, 2 routers used adaptive evasion triggers, and 17 routers interacted with researcher-controlled AWS canary credentials, demonstrating real-world payload injection and secret exfiltration risks.
The study collected 28 paid routers from Taobao, Xianyu, and Shopify-hosted stores and 400 free routers from public communities to evaluate whether intermediary services could inspect or alter plaintext tool-calling traffic between clients and upstream model providers.
In March 2026, attackers reportedly used a dependency confusion attack against LiteLLM to insert malicious code into the router's request pipeline. The compromise gave the attackers access to traffic handled by the router, illustrating real-world risk in the LLM routing layer.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
6 references tracked. Mallory keeps watching after this page renders.
kaspersky.com
Open sourcehackers-arise.com
Open sourcehelpnetsecurity.com
Open sourceinfosec.pub
Open sourcearxiv.org
Open sourcearxiv.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers reported escalating **criminal abuse of large language model (LLM) infrastructure**, including active exploitation of exposed or weakly authenticated AI service endpoints. Pillar Security documented more than **35,000 attack sessions** over ~40 days against honeypots and attributed the activity to an operation dubbed **“Bizarre Bazaar,”** described as an early example of actor-attributed “**LLMjacking**.” The activity targeted misconfigured/self-hosted deployments and AI APIs (including **unauthenticated Ollama endpoints on `11434`** and **OpenAI-compatible APIs on `8000`**), with attackers moving quickly once endpoints appeared in internet-wide scanners such as Shodan/Censys. Reported objectives included **stealing compute** (e.g., crypto mining), **reselling illicit API access** on underground markets, **exfiltrating prompt/conversation data**, and attempting **pivoting into internal systems** via publicly accessible **Model Context Protocol (MCP) servers**. Separately, Palo Alto Networks **Unit 42** described a proof-of-concept phishing technique where a benign-looking page calls a legitimate LLM API to generate **per-victim JavaScript** in real time, assembling a **personalized phishing site** in the browser to reduce the presence of static indicators and evade traditional detections; researchers noted similar building blocks are already being used for obfuscated JavaScript and malware-related activity.
Jun 29, 2026
Threat actors are actively exploiting misconfigured proxy servers to gain unauthorized access to paid Large Language Model (LLM) services, including those from OpenAI, Google Gemini, Anthropic, Meta, and others. These attacks, referred to as "LLMjacking," involve advanced enumeration techniques, server-side request forgery (SSRF), and the use of custom scripts to identify and hijack exposed LLM endpoints. The attackers leverage distributed virtual private server (VPS) infrastructure and sophisticated operational security measures, indicating a well-resourced and coordinated campaign. Stolen access to these commercial AI endpoints is being monetized on underground forums, highlighting the financial motivation and the growing underground market for compromised LLM credentials. Recent threat intelligence and incident reports confirm that this campaign has been ongoing since late 2025, with systematic, low-noise probing of enterprise AI infrastructure. Security researchers have observed attackers actively attempting to access various LLM pathways, including through honeypots set up for OpenAI, Gemini, and Claude endpoints. While there is no direct attribution to known APT groups, the technical sophistication and scale of the operation suggest involvement by organized cybercriminals or advanced grey-hat operators. Organizations are urged to review and secure their proxy configurations and monitor for unusual access patterns to prevent unauthorized use of their paid AI services.
Jun 29, 2026
A researcher observed an attacker using a semi-autonomous coding agent to identify poorly secured OpenAI-compatible LLM resale gateways and obtain access through registration flaws, default credentials, authorization weaknesses, and account farming. The agent validated harvested inference endpoints and consolidated usable capacity behind an attacker-controlled, self-hosted New-API gateway, creating a supply chain for stolen or abused LLM access. The captured operation loaded about 379 upstream endpoints, disabled 341 that failed validation, and presented five model aliases through a unified service with load balancing and failover. After choosing an AI honeypot as a free LLM backend, the agent exposed extensive operational data—including playbooks, reconnaissance material, API keys, target details, and working history—indicating a human-directed automated operation rather than a fully autonomous or self-replicating campaign.
Sep 11, 2026