Attackers Abuse AI Services and Exposed LLM Infrastructure for Intrusions and Compute Theft

Researchers and vendors reported a sharp rise in attacks targeting AI infrastructure, from exposed self-hosted LLM servers to commercial coding assistants used in real intrusions. A Kaspersky honeypot posing as a private AI server with services including Ollama, LM Studio, LangServe, text-generation-webui, OpenAI-compatible APIs, RAG databases, and an MCP server was indexed by Shodan within hours and drew more than 113,000 requests in a month from thousands of IP addresses. Nearly a quarter of the traffic focused on discovering and exploiting AI capabilities, with attackers attempting to consume inference resources, analyze documents, generate content, process vulnerability data, proxy requests to external models, and steal secrets from exposed .env files using tooling such as LLM-Scanner.

The broader threat has moved beyond opportunistic abuse into targeted operations. Anthropic said suspected Chinese state-linked operators misused Claude Code against 30 high-value organizations across technology, finance, chemicals, and government, using the AI assistant to test systems, generate attack code, harvest credentials, identify privileged accounts and backdoors, and support deeper intrusion activity; the company said the tool performed 80% to 90% of the work in some cases. Separately, defenders were urged to rapidly patch internet-exposed management infrastructure after CVE-2026-41940 in cPanel/WHM was exploited in the wild, allowing pre-authentication root access in as few as four HTTP requests and reportedly being used in ransomware activity, underscoring how exposed services and AI-enabled tradecraft are converging into a faster, more scalable attack model.