Loading story…
An internet-exposed LLM inference honeypot was discovered, relabeled as a desirable free model backend, and received a genuine OpenCode coding-agent request. The OpenAI-compatible request exposed conversation history, filesystem-derived output, working directories, tool results, and the agent’s local tool manifest, indicating that untrusted inference endpoints can collect sensitive development context.
The exposed agent advertised file read, write, and edit capabilities plus PowerShell-capable Bash access, with tool_choice set to automatic. Although the honeypot sent no tool-call responses and no malicious commands executed, the incident demonstrates that a rogue model provider could potentially solicit local tool execution or sensitive-file reads from permissively configured agents. Organizations should treat model base URLs as trusted control-plane dependencies, allowlist approved providers, restrict agent tool permissions, and investigate data sent to untrusted endpoints.
Track how attackers are adapting to this technology.
6 events from the most recent confirmed update back to the earliest known activity.
The honeypot received 210 copies of a 224 KB OpenCode request over 91 seconds, containing an 88-message Windows coding-agent transcript. The request exposed chat history, filesystem paths and listings, tool outputs, portions of local files, and an 11-tool manifest, but the honeypot returned fixed prose and did not trigger tool execution.
The opencode/0.2.0 client requested fofa-sol-NNNNN, fofa-ds-NNNNN, and fofa-opus-NNNNN within three seconds, consistent with testing multiple aliases against the same backend.
A NodeHealthCheck/1.0 (+local-lab) client requested the fofa-opus-NNNNN alias, behavior assessed as consistent with health checking for a backend pool.
A client identifying as opencode/0.2.0 probed unadvertised aliases including auto/best-coding, auto/claude-opus, auto/claude-sonnet, and auto/best-reasoning.
The honeypot recorded 115 requests from 20 IP addresses during a scanning spike; the requests reused model names returned by its /v1/models endpoint.
An unauthenticated inference honeypot was exposed publicly, serving OpenAI-compatible endpoints, an Ollama-style API, and an MCP server while advertising four local models.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
2 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourceisc.sans.edu
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A researcher observed an attacker using a semi-autonomous coding agent to identify poorly secured OpenAI-compatible LLM resale gateways and obtain access through registration flaws, default credentials, authorization weaknesses, and account farming. The agent validated harvested inference endpoints and consolidated usable capacity behind an attacker-controlled, self-hosted New-API gateway, creating a supply chain for stolen or abused LLM access. The captured operation loaded about 379 upstream endpoints, disabled 341 that failed validation, and presented five model aliases through a unified service with load balancing and failover. After choosing an AI honeypot as a free LLM backend, the agent exposed extensive operational data—including playbooks, reconnaissance material, API keys, target details, and working history—indicating a human-directed automated operation rather than a fully autonomous or self-replicating campaign.
Sep 11, 2026
Security researchers reported that AI coding agents are increasingly setting off endpoint detections because their routine actions resemble attacker tradecraft on both macOS and Windows systems. Hunt & Hackett described a macOS investigation in which a shell process ran ```bash security dump-keychain -a ``` and filtered the results for a Bitbucket API token, initially appearing to be credential theft before investigators tied the activity to a legitimate developer using an AI-assisted coding environment. Sophos separately observed Windows telemetry showing agents such as **Claude Code**, **Cursor**, **OpenAI Codex**, and tools built on **GStack** triggering detections associated with **Credential Access** and **Execution**, including DPAPI-based browser credential decryption, Python access to browser credential stores, and `cmdkey.exe` enumeration of Windows Credential Manager entries. The reported activity also included repeated LOLBin-based download attempts using trusted utilities and at least one blocked startup-folder persistence attempt linked to Cursor, underscoring how benign agent behavior can overlap with high-confidence intrusion signals. Researchers said the observed cases were not malicious, but warned that autonomous agents, weak logging of intent, prompt-injection risk, and permissive settings such as Claude Code's dangerous no-approval mode can turn similar workflows into genuine incidents. They recommended treating AI agents as a new execution layer with **least privilege**, isolation, stronger approvals for sensitive actions, and continued strict monitoring of credential-store access rather than broadly suppressing detections.
Jul 12, 2026
Researchers analyzing more than 1,000 recovered AI agent sessions found that a low-skilled attacker used Anthropic’s **Claude Code** and OpenAI’s **Codex** to carry out offensive cyber operations against at least 14 companies. Logs from a compromised Vultr-hosted system showed the operator using the tools for reconnaissance, vulnerability discovery, exploit development, credential harvesting, database replication, session impersonation, cloud and API key testing, mail-account takeover attempts, and lateral movement. The sessions also documented requests for stealth, anti-forensics, transcript editing, encrypted reporting, and migration of stolen data, while some generated **pentest-style reports** that included monetization estimates for exfiltrated information. Investigators said the attacker reused stolen local AI agent installations and made operational security mistakes that helped attribute the activity to a young man in Addis Ababa, Ethiopia. Separate analysis of a **Claude Code** network sandbox bypass highlighted why AI agent misuse can extend beyond unsafe model output into runtime and infrastructure controls. NSFOCUS reported that proxy-based filtering could be bypassed because policy checks evaluated the original input while the network layer parsed and truncated it differently, including with invisible control characters or null bytes, creating a path for outbound requests and possible data leakage in a single execution chain. Although the issue was reportedly fixed in later versions, researchers said the low-profile remediation made exposure difficult to assess and underscored the need for layered defenses such as strict egress allowlisting, least privilege, short-lived secrets, auditing, fail-closed policies, and fuzz testing of parsing paths.
Jun 29, 2026