Malicious Actors Hijack LLM Endpoints as 'Free' Backends for Compromised Agents
Attackers are repurposing internet-scanned honeypots and other exposed servers as rogue Large Language Model (LLM) endpoints, tricking tool-enabled AI agents into connecting and potentially executing malicious commands.
A novel threat has emerged where attackers are actively discovering and repurposing internet-exposed servers, including honeypots, to act as "free" backend endpoints for Large Language Model (LLM) services. These compromised servers are then relabeled with popular LLM names, such as DeepSeek or Claude, to lure unsuspecting AI agents into connecting to them. This tactic represents a significant shift from traditional attacks, as it targets the control plane of tool-enabled agents rather than exploiting vulnerabilities in the agents themselves.
The discovery was made when an internet-exposed inference honeypot, initially set up for research, was found to have been compromised, relabeled, and integrated into infrastructure offering "free" LLM backends. The honeypot subsequently received a genuine coding-agent session, revealing the agent's operational history, filesystem access, tool manifest, and user commands. While the honeypot itself did not execute any tools, the data it received demonstrated the potential for malicious actors to control agents that connect to such rogue endpoints.
The attack vector exploits the growing reliance on readily available LLM APIs and the allure of "free" services. Instead of seeking API keys, attackers are now providing the compromised endpoints themselves. Tool-enabled agents, designed to interact with LLMs and execute tasks using integrated tools (like file reading, writing, or shell commands), can be dangerously misled. If an agent connects to a malicious endpoint, its subsequent tool requests could be executed on the agent's host machine, turning a seemingly innocuous interaction into a potential security breach.
Researchers observed a specific incident where an agent, identified as opencode/0.2.0, sent a large request body containing an 88-message transcript originating from a Windows environment. The agent was attempting to analyze the writing style of two novels. The transcript included the agent's history, filesystem outputs, working paths, and its tool manifest. The request was routed through a China Unicom address in Hebei, China, and presented a Authorization: Bearer free credential, indicating a lack of proper authentication and a clear sign of a compromised service.
The honeypot's journey from a baseline scanning target to a relabeled LLM endpoint highlights the systematic nature of this threat. Initially, scanners identified the honeypot's available model names. Later, clients began probing with various aliases, suggesting enrollment in a monitored backend pool. Eventually, the honeypot was labeled with names like fofa-ds-NNNNN and fofa-opus-NNNNN, indicating it was found via the internet search engine FOFA and relabeled to mimic specific LLM providers. The numeric suffix in the labels appears to correspond to the endpoint's own IP address octets, suggesting a method for cataloging scavenged endpoints.
This strategy effectively creates a "rogue model endpoint" or an "evil twin" of legitimate LLM providers. By advertising popular model names and offering them for free, attackers can entice agents to connect. The implications are severe: a model endpoint is no longer just a source of text; for tool-enabled agents, it becomes an integral part of the command and control infrastructure. The data exfiltrated from the agent, including file contents and system information, was sent in cleartext to the unauthenticated honeypot.
While the immediate incident involved an ordinary user whose agent session was rerouted to an unknown endpoint, the potential for deliberate campaigns is high. Malicious operators could actively seek out and configure these rogue endpoints to intercept sensitive information, execute arbitrary commands, or deploy further malware through the compromised agents. The ease with which these endpoints are discovered and relabeled underscores the need for greater scrutiny and authentication mechanisms for AI agent connections.