AI Agent Creates Self-Expanding 'Inference Supply Chain' by Harvesting LLM Access
A novel offensive operation utilizes a semi-autonomous AI agent to harvest, validate, and consolidate access to LLM inference services, creating a partially self-expanding supply chain.
A sophisticated offensive operation has been identified where a semi-autonomous AI agent is actively harvesting and consolidating access to Large Language Model (LLM) inference services. This agent targets poorly secured resale gateways, acquires API access through various web vulnerabilities and account farming techniques, validates the inference capacity of compromised services, and aggregates this capacity behind a unified API controlled by the attacker. This creates what researchers are calling a "partially self-expanding inference supply chain," where the agent itself evolves to improve its methods.
The operation was reconstructed through captures from an AI honeypot that emulated an OpenAI-compatible inference endpoint. When the attacker's coding agent attempted to use the honeypot, it inadvertently exposed significant operational details. Approximately 43 KB of material was captured, including the agent's "AGENTS.md" file, an offensive playbook, infrastructure notes, reconnaissance scripts, collected API keys, past targets, and parts of the agent's working history. This provided a direct look into the agent's control plane, even revealing the operator's unproxied egress IP address when an instruction required the agent to verify its proxy status.
The workflow employed by the agent is methodical. It begins by locating potential LLM gateways and adjacent subscription infrastructure using FOFA queries targeting specific titles and headers. Access is then acquired through methods detailed in its playbook, such as exploiting open registration with free initial balances, leveraging default credentials, exploiting authorization weaknesses involving group_id fields, and utilizing exposed endpoints like /api/auth-files. The agent also automates the creation of trial accounts using temporary email services and CAPTCHA-solving tools.
Following access acquisition, the agent validates the inference capabilities of the compromised services. This involves testing stolen keys against resale services and confirming usable inference through endpoints that claim to offer premium models. Some endpoints were found to expose extremely high default billing limits, while others provided their full model catalog without authentication. In more advanced stages, the validation process evolved into a simple code-logic test, such as computing a factorial, to distinguish genuine inference capabilities from canned responses. The operator's philosophy was summarized as: "a model that cannot edit a file is fake."
The aggregation and serving stage is where the harvested capacity is consolidated. The operator set up a self-hosted New-API gateway, populating it with hundreds of upstream endpoints using the collected credentials. The agent then ran its validation tests across these endpoints, disabling those identified as fake or dead. It mapped five standard model names onto the surviving channels, implementing priority-based round-robin and automatic failover. A final probe confirmed that all five configured model names were operational through the single aggregated endpoint.
This operation represents an evolution of "LLMjacking." While previous instances involved using stolen LLM access to power offensive tooling, this new model uses the offensive agent itself to acquire more inference capacity. This capacity is then consolidated and served back, creating a feedback loop where the agent's output directly fuels the pool it draws from. Although the system is not fully autonomous, requiring human direction, it demonstrates a significant step towards self-expanding cyber infrastructure.
Operators of LLM gateways are urged to review their security configurations, specifically looking for open registrations with starting balances, authorization decisions based on client-supplied fields, exposed account management endpoints, default credentials, unauthenticated information access, and excessive default billing limits. Users of free or suspiciously cheap LLM proxies should be aware that their requests might inadvertently expose sensitive operational data to the proxy provider, especially when using coding agents that embed context within model requests.