A SANS ISC diary describes a semi-autonomous, semi-cooperative attacker apparatus that harvests and re-sells LLM access by building a self-expanding inference supply chain. The attacker’s AI coding agent locates poorly secured LLM resale gateways, obtains API access through common web flaws and account farming, then validates and aggregates usable inference capacity behind a single gateway.
The operation was captured across multiple honeypot records that showed the agent embedding extensive internal instructions and session context in model requests, including a roughly 43 KB payload containing an AGENTS[.]md, an offensive playbook, infrastructure notes, reconnaissance scripts, collected API keys, and prior targets. This revealed not merely stolen credentials but an inner control plane being transmitted to the observer.
The capture outlines a three-stage workflow: first, Find supply by generating FOFA-like queries to locate gateways and subscription infrastructure; second, Acquire access via open registrations, default credentials, weak authorisations and endpoints such as /api/auth-files, including automated trial accounts; third, Validate inference by testing compromised keys against resale services and verifying usable endpoints advertising premium models, sometimes with unauthenticated model catalogs or high default billing limits.
In the subsequent scene, the operator stood up a self-hosted New-API gateway and loaded roughly 379 upstream endpoints, mapping five model names (deepseek-v4-flash, claude-opus-5, gpt-5.6-sol, gemini-3.6-flash-high, glm-5.3) to surviving channels with failover. The final step demonstrated the aggregated inference service working through a single endpoint, with adjustments to the gateway database when rate limits blocked automation.
The article warns operators to scrutinise open registrations, unauthenticated endpoints and default credentials, and to recognise that such checks could be run continuously by agents rather than manually.