Cybersecurity researchers have uncovered a sophisticated and self-expanding supply chain attack that leverages artificial intelligence (AI) agents to harvest, validate, and consolidate access to Large Language Model (LLM) inference capacity. The operation, which we’ll refer to as an “inference supply chain,” has the potential to significantly impact organizations relying on LLMs for a range of applications.
The attacker’s coding agent uses a combination of semi-autonomous techniques to identify poorly secured LLM resale gateways, acquire API access through common web vulnerabilities and account farming, validate the resulting inference capacity, and aggregate it behind a single gateway. What sets this operation apart is its use of a feedback loop, where the agent helps acquire new inference capacity, validates and consolidates it, and makes that capacity available to support further operations.
The researchers captured evidence of this supply chain through an AI honeypot, which emulates an OpenAI-compatible inference endpoint. When the operator’s coding agent attempted to use it, the request exposed much more than an exploit payload. The honeypot received approximately 43 KB of material, including a large AGENTS.md file, an offensive playbook, infrastructure notes, reconnaissance scripts, collected API keys, previous targets, and parts of the agent’s working history.
This evidence suggests that the agent sent part of its own control plane to the honeypot, revealing the operator’s direct IP address. The captured workflow was straightforward: find supply, acquire access, validate inference, and aggregate and serve. The agent used a combination of automated tools and manual effort to locate LLM gateways, acquire API access, test compromised keys against resale services, and confirm usable inference.
The aggregation stage is perhaps the most significant part of this operation, as it shows how the attacker stood up a self-hosted New-API gateway and loaded roughly 379 upstream endpoints into it as channels. The operator then ran code-logic tests across all of them and disabled the ones that failed as fake or dead. This resulted in an aggregated pool of usable inference capacity, which was operational when probed.
The implications of this discovery are far-reaching, as organizations relying on LLMs for applications such as natural language processing, content generation, and predictive analytics may be vulnerable to this type of attack. The aggregation software used by the attacker is a legitimate open-source project, but its abuse highlights the importance of securing credentials and preventing compromised access.
In practical terms, this discovery underscores the need for organizations to implement robust security measures to prevent unauthorized access to LLMs. This includes ensuring that APIs are properly secured, monitoring for suspicious activity, and regularly reviewing and updating dependencies. Furthermore, organizations should consider implementing AI-powered detection tools to identify and mitigate potential attacks like this one.
Source: SANS ISC — 2026-09-11