Threat · curated 1 Jul 2026
Attackers Hijack Exposed AI Endpoints to Power Offensive Ops
First reported zenity.io
Coverage timeline
Single-source incident — first reported, latest, and curated coincide.
Why it matters
Organizations self-hosting LLM infrastructure can unwittingly provide free compute and reasoning capacity to attackers running autonomous offensive tooling if their inference endpoints are exposed without authentication.
Zenity researchers observed three distinct campaigns between March and May in which attackers hijacked exposed, unauthenticated self-hosted AI inference endpoints (Ollama's /api/generate and /api/chat on port 11434, and LiteLLM's /v1/responses on port 4000) to power offensive AI operations. Two operators ran autonomous pentesting frameworks (Strix and HexStrike AI) and one used an OpenAI Codex agent with a persona built to suppress safety refusals for web reverse-engineering. Access requires only knowledge of the exposed endpoint, not authentication.
Summary
Between March and May, researchers at Zenity observed three distinct campaigns in which threat actors hijacked exposed, self-hosted AI inference endpoints to power offensive AI operations, according to Dark Reading reporting that summarizes a Zenity Labs blog post. The attacks required no software exploit or authentication—only knowledge of an Internet-reachable endpoint that an attacker could configure as a model backend for their own agent or client.[0][4]
The technique abuses the inference endpoints that self-hosted AI software exposes for applications, specifically Ollama's '/api/generate' and '/api/chat' endpoints on port 11434 and LiteLLM's '/v1/responses' endpoint on port 4000. Attackers point their own agent or client (such as a LiteLLM client, the CherryStudio desktop app, or the Codex CLI) at the exposed endpoint, delivering the agent's system-prompt persona and tool definitions inside the request body.[0]
Zenity's honeypots captured three operators using the hijacked infrastructure for different purposes: two autonomous penetration-testing frameworks (Strix and HexStrike AI) and one OpenAI Codex agent operating under a persona built to suppress safety refusals while assisting with web reverse-engineering. Zenity CTO and co-founder Michael Bargury warned that any AI system exposed to the Internet should be assumed to be targeted by AI-literate malicious actors within hours.[0]
Attack chain
- Discovery: Attackers locate self-hosted AI inference endpoints exposed to the Internet. Ollama commonly gets misconfigured to bind to all interfaces, and LiteLLM's proxy is Internet-facing on a public host by default, making these endpoints discoverable without any compromise.[0]
- Initial Access / Endpoint Probing: Operators typically send a small 'hello' probe first to confirm the exposed endpoint answers before submitting a full payload. No special authentication is needed because Ollama ships without built-in authentication on its default port 11434 and LiteLLM authentication is opt-in, dependent on a master key; a common placeholder key (sk-1234) is also targeted.[0]
- Weaponization / Payload Delivery: Attackers configure their own agent or client to use the exposed endpoint as its model backend. The agent's entire 'brain'—its system-prompt persona and tool definitions—rides in the request body. In one case a single IP used a LiteLLM client to send a 140,000-character prompt weaponizing Strix, and in another the operator sent HexStrike AI's 150-plus offensive tool toolset to a honeypot's Ollama instance.[0]
- Execution / Offensive Operations: The Strix operator's prompt instructed the agent to never ask for permission, run non-stop, avoid identifying markers, and to 'GO SUPER HARD on all targets,' aimed at an unidentified French auction house. A third IP pointed an OpenAI Codex agent at a honeypot's LiteLLM proxy under a security-auditor persona to conduct web reverse-engineering. Zenity's sensors caught and thwarted the efforts, though persistent 'retry' commands suggested a potential live operator.[0]
Disclosure timeline
| Date | Event |
|---|---|
| March–May 2026 | Zenity researchers observed three distinct campaigns leveraging its honeypots' LLM infrastructure as resourcing for offensive AI operations, exposing Ollama and LiteLLM endpoints.[0] |
| June 30, 2026 | Dark Reading published its article summarizing Zenity's findings and the associated Zenity Labs blog post detailing the hijacking of exposed AI backends.[0][4] |
How it works
The abuse requires no software exploit. It relies on insecure defaults and misconfigurations of self-hosted AI software: Ollama ships with no built-in authentication on its default port 11434 and is commonly misconfigured to bind to all interfaces, while LiteLLM's proxy is Internet-facing by default and its authentication is opt-in, only enforced if a user sets a master key. Attackers also target a common placeholder key, sk-1234.[0]
An attacker configures their own agent or client to use the exposed inference endpoint as its model backend. The agent's system-prompt persona and tool definitions ride entirely in the request body, which is what Zenity's sensors captured. Operators typically send a small 'hello' probe to confirm the endpoint answers, then submit the full agent payload.[0]
Affected versions and patch status
| Product | Affected | Patch status |
|---|---|---|
| Ollama | Self-hosted instances exposing inference endpoints (/api/generate, /api/chat) on port 11434 | No patch; ships with no built-in authentication by default and is commonly misconfigured to bind to all interfaces[0] |
| LiteLLM | Self-hosted proxy exposing /v1/responses on port 4000 | No patch; authentication is opt-in (master key), and proxy is Internet-facing on a public host by default[0] |
Indicators of Compromise
| Type | Indicator | Context |
|---|---|---|
| file-path | /api/generate | Ollama inference endpoint on port 11434 that ships without built-in authentication and can be abused as a model backend when exposed.[0] |
| file-path | /api/chat | Ollama inference endpoint on port 11434 abused by attackers pointing their own agents/clients at exposed instances.[0] |
| file-path | /v1/responses | LiteLLM proxy endpoint on port 4000, Internet-facing by default, that attackers route their agents through.[0] |
| other | port 11434 | Ollama's default port, commonly misconfigured to be exposed to all interfaces.[0] |
| other | port 4000 | LiteLLM proxy's default port, Internet-facing on a public host by default.[0] |
| other | sk-1234 | A common placeholder/default LiteLLM master key that attackers are known to target when authentication is weakly configured.[0] |
Key takeaways
- Internet-exposed self-hosted AI inference endpoints are being actively hijacked as free compute/model backends for offensive AI tooling, requiring no software exploit—only an exposed, unauthenticated endpoint.[0][4]
- Attackers are demonstrating increasing AI-agentic literacy; defenders should assume any AI system placed on the Internet will be targeted by AI-literate actors within hours.[0]
Defensive actions
- Do not expose model backends to the Internet where possible.: The attacks require only knowledge of an exposed endpoint; removing Internet exposure eliminates the primary attack surface.[0]
- Require real authentication and reject default or placeholder keys.: Ollama lacks default authentication and LiteLLM authentication is opt-in; attackers target placeholder keys like sk-1234.[0]
- Inspect request bodies from outside sources and monitor traffic to AI infrastructure.: The agent's full persona and tool definitions ride in the request body, so inspecting bodies can reveal full-agent payloads rather than standard prompts.[0]
- Block full-agent payload indicators, penetration-testing tool signatures, unsafe personas, requests for unhosted models, and known operator IPs.: Zenity recommends watching for requests carrying full suites of tooling, unsafe personas, or models the organization does not host, and blocking operator IPs.[0]