Living Off Someone Else's Inference

The talk argues that attackers increasingly want someone else's LLM compute, because using their own API keys leaves a billing and identity trail and gets expensive once agent loops run for millions of tokens. The presenters walk through finding exposed inference servers, such as LiteLLM, Ollama and vLLM deployments, with internet search queries, then confirming that an endpoint answers a basic chat request.

A central problem is honeypots. The team describes three patterns they saw: servers that return the same reply no matter the input, canned conversations with no model behind them, and small local models advertised under the names of frontier models. Their tool checks for these and blacklists suspicious hosts, and the speakers say a stronger model-identity check is planned for a later version. They demonstrate pointing a coding agent at a cheap model served from a remote host, and they also show a scanner that finds API keys in a private repository.

They close with a command-and-control agent built on Mythic that delegates post-exploitation tasks to an LLM through existing callbacks. The takeaway for defenders is to lock down inference endpoints and API keys, since exposed compute and credentials give adversaries free, unattributed capacity.