How attackers are gaining access to LLM inference

Executive summary: The report analyzes how threat actors gain free or anonymous access to LLM inference—via underground offensive models, crypto-based middlemen, free/keyless APIs, leaked API keys, and exposed self-hosted servers—presents active scan results and evidence of automated exploitation across platforms (LocalAI, Ollama, llama-server, ComfyUI, Langflow, n8n, etc.), documents malware families that wire live LLM APIs into payloads for reconnaissance, code generation, and credential theft, and provides IOCs and mitigation advice (authenticate services, avoid public exposure, patch CVEs, and audit running models).