Attackers Seize Exposed AI Endpoints to Power Offensive Ops

Zenity researchers observed three active campaigns (March–May) in which attackers discovered and abused exposed Ollama and LiteLLM inference endpoints to use those hosts as model backends and execute malicious AI agents (Strix, HexStrike, and a Codex persona). By pointing LLM clients at internet-facing endpoints that often lack authentication or use default keys, attackers delivered full-agent payloads to orchestrate penetration-testing tooling and web reverse-engineering without needing a traditional software exploit; Zenity recommends not exposing model backends, enforcing authentication, inspecting request bodies, and monitoring AI infrastructure.