Exposed LLM Backends Are Becoming Attacker AI Compute
Zenity's honeypots saw operators point autonomous agents and LLM clients at exposed Ollama (a local LLM serving runtime) and LiteLLM (an AI gateway for routing LLM requests) backends. The defender's model server did not have to be exploited with malware; being reachable, unauthenticated, or protected only by a placeholder key was enough to turn it into attacker-funded inference infrastructure.
Exposure is the entry point. Operators found reachable Ollama /api/generate or /api/chat endpoints on port 11434, plus LiteLLM /v1/responses proxies on port 4000.
The auth failure is simple and expensive. Ollama has no built-in auth on its default API surface, and LiteLLM enforces proxy auth only when a real master key is configured. No key, a blank key, or sk-1234 can turn reachability into usable compute.
The agent brain rides in the request body. Zenity observed Strix, HexStrike AI, and a customized Codex-style agent sending system prompts, tool definitions, and task context to exposed backends.
The risk model changes for self-hosted AI. An exposed model endpoint is no longer only a data-leak or cost-abuse issue. It can become the inference layer for offensive automation aimed at third-party targets.
The defender-owned fix is concrete. Bind backends to private interfaces, require service authentication, meter every caller, log agent-shaped payloads, and cut off low-trust or high-spend sessions automatically.
The cleanest break point is before inference. Ollama and LiteLLM backends should require real service or admin identity, with managed API keys or OAuth-style service credentials. A placeholder key or unset master key should never be a production access path to model compute.
Model-serving ports should not be reachable from the public internet. Placing Ollama and LiteLLM behind private network segments, gateway-only ingress, and least-privilege firewall rules removes arbitrary internet scanners from the path.
Public AI Endpoint & Agent-Service Exposure Discovery
Very High
Run credential-free discovery outside the trusted network to identify organization-owned Ollama, LiteLLM, and other Internet-reachable inference routes. Reconcile each response to an owner, approved exposure intent, and authentication state, then emit the exact unknown or placeholder-auth finding; this control does not take the backend down or remediate it.
Enforce cumulative token, tool-call, concurrency, GPU/CPU, and spend budgets at the inference gateway. When an exposed or abused key exceeds its signed budget, the gateway can throttle, block, or force safe mode before more attacker-controlled reasoning consumes model capacity; this directly caps continuing compute and financial loss even when request rate alone looks normal.
This incident is exactly what secure-baseline gates are meant to catch: public IPs on model servers, wide-open ingress, missing auth, default keys, and unsafe bind addresses. Treat those as release blockers for AI infrastructure.
The request body contains the evidence: agent system prompts, tool schemas, model names, caller headers, and probe-to-payload progression. Structured, redacted AI request logs make this distinguishable from ordinary inference usage.
Attacker-owned agents create visible resource signals: abnormal token volume, retry bursts, long contexts, tool-array shaped requests, and spend spikes. These signals should trigger alerts before the backend quietly funds an offensive loop.
This is the more precise detection layer for the brief's unique telemetry. Defenders should look for AI-service traffic that carries agent system prompts, tool schemas, offensive framework names, unusual payload shape or entropy, and correlations across API key, gateway, identity, endpoint, and proxy logs, not only token volume or cost spikes.
After exposure, authentication, budget, and detection changes are deployed, independently replay the original unauthenticated and placeholder-key request patterns and verify the exact abuse paths fail across the incident-scoped backend population. This verifies closure; it does not implement those configuration changes.
What Defenders Should Do Now
Inventory every self-hosted Ollama, LiteLLM, vLLM, TGI, LM Studio, and OpenAI-compatible proxy endpoint. Record bind address, public reachability, auth mode, owner, model list, and network segment.
Move model backends behind private interfaces or authenticated gateways. Do not expose raw inference ports directly to the internet, even for testing.
Reject placeholder credentials and unset master keys in deployment checks. Treat sk-1234, blank keys, and unauthenticated proxy mode as production-blocking findings.
Log and alert on large request bodies, agent-style tool arrays, offensive framework names, repeated retries, unusual user agents, and token or spend spikes by caller identity.
Add automatic containment: throttle low-trust callers, suspend suspicious keys, block abusive source IPs, and force safe mode when token or spend budgets are crossed.
Conclusion
The lesson is not that every exposed backend was fully compromised. The lesson is sharper: model-serving capacity is now useful attacker infrastructure by itself. If an LLM backend is reachable without strong identity, budgets, logs, and private network boundaries, it can become someone else's AI compute layer.