The Self-Expanding Stolen Inference Supply Chain: An AI Agent Harvesting and Re-Serving LLM Access, (Fri, Sep 11th)

The author captured a live operation in which an attacker-operated coding agent automated discovery of LLM resale gateways, account/key acquisition (via open registration, default creds, trial accounts), validation of inference capability, and aggregation of hundreds of upstream endpoints into a single self-hosted API gateway—producing a partially self‑expanding inference supply chain that can be reused to support further offensive activity.