The Self-Expanding Stolen Inference Supply Chain: An AI Agent Harvesting and Re-Serving LLM Access, (Fri, Sep 11th)

A cyber threat intelligence report details a sophisticated attack chain where a coding agent systematically exploited vulnerabilities in LLM resale gateways to build a self-expanding inference supply chain. The agent identified and acquired access to these gateways through various methods, including open registration, default credentials, and account farming. It then validated the inference capacity of these gateways and aggregated them into a single, unified API, effectively creating a partially self-expanding system for delivering stolen LLM access. The attacker’s playbook and captured data revealed a detailed operational workflow, highlighting the importance of proactively securing LLM gateways against similar attacks.

What happened The report outlines a multi-stage attack where a coding agent was used to identify and exploit vulnerabilities in LLM resale gateways. The agent’s primary goal was to acquire and consolidate inference capacity, creating a self-expanding supply chain. The operation began with the agent actively searching for potential targets using queries like "title='V2Board'" and "header='subscription-userinfo'" to locate LLM gateways and adjacent subscription infrastructure. It then acquired access through various means, including open registration with free balances, authorization weaknesses based on client-supplied fields such as group_id, exposed account-management endpoints, default credentials, and unauthenticated model or account information. The agent validated the inference capacity of these gateways by testing candidate keys against resale services and confirming usable inference through endpoints advertising premium models, even identifying gateways with extremely high default billing limits.

Technical details

• **Attack Vector:** Exploitation of vulnerabilities in LLM resale gateways, including weak authentication, default credentials, and exposed endpoints.
• **Affected Products/Vendors:** The report doesn't specify vendors, but the attack targets LLM resale gateways.
• **CVE/CWE Identifiers:** Not applicable – this is a novel attack.
• **Exploitation Status:** Exploitation is active and ongoing.
• **CVSS Score:** Not applicable – this is a novel attack.
• **Agent:** A custom coding agent used to automate the entire process.
• **Gateway:** A self-hosted New-API gateway used to aggregate and serve inference capacity.

Impact

The scope of the attack is potentially broad, as it relies on exploiting a large number of LLM resale gateways. The real-world risk is the potential for malicious actors to leverage stolen inference capacity for various offensive activities, such as generating disinformation, creating deepfakes, and automating attacks. The attack demonstrates a significant shift in how LLM access is stolen and utilized, moving beyond simple credential theft to a more sophisticated and self-sustaining supply chain.

What to do

• **LLM Gateway Security:** Review LLM gateways for vulnerabilities such as weak authentication, default credentials, and exposed endpoints. Implement multi-factor authentication and regularly audit access controls.
• **Agent Monitoring:** Monitor coding agents for suspicious activity, including attempts to access LLM gateways and the transmission of large amounts of data (e.g., AGENTS.md).
• **Data Minimization:** Limit the amount of information sent to LLM gateways, avoiding the transmission of operational context and source code.
• **Continuous Monitoring:** Implement continuous monitoring and threat detection systems to identify and respond to attacks targeting LLM gateways.

Why it matters

The attack highlights a growing trend of leveraging LLM access for malicious purposes and the increasing sophistication of threat actors. It demonstrates that stolen LLM inference capacity can be effectively consolidated and reused, creating a self-sustaining supply chain for offensive operations. The report underscores the need for proactive security measures to protect LLM gateways and prevent the exploitation of these valuable resources.