For two years, an exposed AI model server was a cost problem. Somebody found your unmetered inference, resold it at a discount through a reverse proxy, and you paid the bill at the end of the month. That was LLMjacking as the Sysdig Threat Research Team named it in May 2024, and as it industrialized through 2025 into a black market brokering stolen tokens on Discord and Telegram.
On June 12 2026 that changed. Sysdig TRT watched a threat actor point an automated exploitation pipeline at a misconfigured Ollama server and use it as the reasoning engine. Not chatting with it. Not reselling it. Wiring it into software that scans a target, matches it to a CVE, writes the exploit, and tries the door, with the model deciding at every step. Your spare GPU capacity is now somebody’s attack infrastructure, and the reason you will not see it in your logs is that an exposed server is by definition one nobody is watching.
What LLMjacking was, and what it just became
The arc is short. Sysdig TRT coined LLMjacking in May 2024 after catching operators use stolen cloud credentials, initial access via Laravel’s CVE-2021-3129, to reach a victim’s paid model services. The victim paid the invoice. Sysdig modeled a worst case above $46,000 per day for Claude 2.x at quota across regions, and later observed a single account that had burned 865.59 million Claude 3 Opus tokens estimated at $38,951.55.
By 2025 LLMjacking was a supply chain. Access was resold through the purpose-built OAI Reverse Proxy as time-limited tokens, and Pillar Security’s honeypot data through late 2025 and early 2026 mapped a scanner, validator, marketplace flow, with one broker (silver.inc) fronting more than thirty providers at 40 to 60% discounts on Dutch bulletproof hosting. Pillar recorded roughly 35,000 sessions between December 2025 and January 2026, averaging 972 attacks per day, with validation attempts following public scan results within two to eight hours.
Then the abusable surface moved. Organizations started serving their own models, and Ollama listens on port 11434 with no authentication by default, so a server reachable from the internet answers anyone who finds it. The June 12 2026 capture is the turn. Same theft, different purpose. The third act of LLMjacking is not about your invoice at all: the asset stopped being compute and became an execution engine.
Why your box beats a stolen API key
The economics are simple. A stolen hosted key is rate-limited, billed, and attributable, so it burns down and it points somewhere. An exposed self-hosted server is unmetered and unattributed: no quota, no invoice, no account to suspend. For a tool that makes hundreds of model calls per attempt, that difference decides whether the tool is affordable at all.
The cost of running offensive AI tooling is collapsing toward zero for anyone willing to steal someone else’s compute. (Sysdig TRT, June 17 2026)
The detail that proves the substitution: across the captured campaign the tool asked the server by name for gpt-4o-mini, claude-3-5-sonnet, and gemini-2.0-flash-exp. None of those are Ollama models. It was a backend-agnostic tool whose operator had simply repointed the model backend from a paid API to a free one, and the requests kept the model names from the original configuration.
What the captured tool actually did
Because the framework sent its full instructions to the model on every request, Sysdig captured the whole architecture. The pipeline runs nine stages: service fingerprinting (normalize an nmap banner to a CPE identity), vulnerability matching and applicability triage, web reconnaissance over an observation bundle, proof-of-concept synthesis, blind time-based SQL injection with filter-evasion inferred from timing probes, credential and secret extraction (the most-invoked stage, run well over a hundred times), arbitrary file-read planning, privilege escalation, and an autonomous orchestrator that drives the chain until it gets command execution.
Two engineering details matter more than the stage list. First, the orchestrator hands the model a fixed named tool surface: a request() primitive, a JWT forger, a PHP object-injection gadget generator, one-shot ssrf_scan and object_injection_scan sweeps. The model chooses moves against that surface instead of writing code it would get wrong. Second, a variant instructs the model that it is PROPOSE-ONLY while a separate deterministic verifier the author calls oracles.py decides whether anything actually fired. The author names this split the zero-false-positive invariant, inside the system prompt. Naming an internal source file and a design invariant to your own model is the signature of maintained software, not a script.
The captured orchestrator prompt frames the run as an “authorized penetration test.” Sysdig is explicit that this is a jailbreak wrapper to keep the model cooperative, not evidence of authorization. Every model provider trains against attack-assistance requests, and “you are helping an authorized pentester” is one of the cheaper ways around that training.
The payoff is a recipe format. Once a probe returns uid=, the working request is frozen with the command field parameterized as __VAPTCMD__, turning one exploit into a reusable command-execution primitive that no longer needs the model to reason about it.
The tells that generalize
Four signals, ordered by fidelity. The first is our generalization from Sysdig’s capture rather than a published rule; the others are patterns Sysdig and Pillar document directly.
- A model name your server has never hosted. An Ollama box asked for
claude-3-5-sonnetorgpt-4o-miniis not a user typo at that specificity. It is somebody else’s backend-agnostic tool pointed at your compute. This is cheap to alert on, hard to trip accidentally, and it is the single best signal in the whole capture. - Marker-bracketed command output. The framework confirms execution with
echo VAPTb3gin; id; echo VAPTfinand looks for the markers around the output ofid. Sysdig notes the same wrap-output-in-sentinels pattern across other agent-driven operators with different marker strings, and the reason is structural: a human reading a terminal does not bracket output for a parser, an automated tool does. Alert on the shape, not onVAPT. - Structured-output contracts arriving at an inference endpoint. Requests demanding STRICT JSON against a fixed schema, repeated verbatim across dozens of calls, are a pipeline consuming the output deterministically, not a person asking questions.
- LLMjacking marketplace validation fingerprints. Pillar observed authentication attempts using placeholder keys such as
sk-test,test-token, anddev-key, and multi-provider enumeration where one source address probes several different LLM frameworks in sequence.
Why your logs will not show you this
There is a structural blind spot here, and it is the most useful observation in Sysdig’s write-up. Detection that watches a model server’s own logs assumes the operator owns and monitors that server.
An exposed server found by an outside actor is, by definition, one nobody was watching.
What the owner sees is elevated compute utilization and an open port. What the owner does not see is a nine-stage exploitation pipeline running through their hardware. The asset-class error causes it. An exposed inference endpoint gets filed as a cloud-cost anomaly or a shadow-AI governance item, and it is neither. It is an unauthenticated compute service with outbound network access sitting on your network, and it belongs in the same mental bucket as an exposed database, an open Jenkins, or a Redis instance on 0.0.0.0. The model’s judgement, which is where most of the AI security conversation lives, is not what failed here. The port it listens on is.
The scale of the enabling condition depends on which question you ask, and the three main data points answer three different questions. Intruder queried more than 5,000 exposed Ollama instances in late 2025 and 31% answered an unauthenticated prompt. LeakIX counted 12,269 instances exposed with zero authentication in February 2026, roughly a thousand of them on versions vulnerable to CVE-2024-37032 (Probllama, unauthenticated RCE as root). Ollama’s maintainers have stated they do not plan to add authentication to the server itself. Of the three, “answered an unauthenticated prompt” is the measure with operational meaning: those servers were not merely reachable, they were serving.
Model exposure costs you compute. MCP exposure hands over file systems, databases, shell, and cloud APIs, which is a different blast radius entirely; we walked through that in The MCP server attack surface. Pillar’s honeypot data makes the split concrete: by late January 2026, 60% of the traffic hitting their AI-infrastructure sensors was a separate MCP-focused reconnaissance campaign, with different objectives and different operators.
The honest read on this particular actor
One caveat carries real weight. Every target the framework touched was private: RFC 1918 space in 172.30.0.0/24, loopback, and on June 14 a 10.129.0.0/16 range consistent with the HackTheBox lab VPN. The applications under test were fictitious practice apps the actor stood up themselves. No public host appeared as a target in the entire capture window.
The pipeline grew stage by stage across an eight-hour session, and individual stages were rewritten in place. That is a developer’s write-test-refine loop, and by the June 14 run the additions had been folded into the baseline. Sysdig says intent is still unclear and the activity could be legitimate, while noting that the resource theft is illegal regardless.
So the accurate framing is a maturing offensive tool caught in development on somebody else’s electricity. That is an unusually early vantage point rather than a body count, and it is worth being precise about, because no production environment has been shown to be a victim here. What generalizes is the enabling condition, which is mundane and widespread, and the fact that stolen compute is what funds the next iteration of the tool.
What we’d do this week
- Scan your own external ranges for the inference defaults, port 11434 for Ollama and 8000 for OpenAI-compatible APIs, the way the attackers do. They are using Shodan and Censys, and Pillar observed exploitation attempts beginning within hours of an endpoint appearing in scan results.
- Put authentication in front of every model endpoint. Ollama has none built in and the maintainers have declined to add it, so it has to come from an authenticating reverse proxy or the network layer. The server should bind to localhost or an internal interface, not
0.0.0.0. - Write one alert for a model name your server has never hosted. It is a handful of lines, it is specific to your deployment, and it catches the exact substitution in this case.
- Audit MCP exposure as a separate exercise from model exposure. The blast radius is different in kind, and no MCP server should be reachable from the internet at all.
- Put inference endpoints in the asset inventory as unauthenticated services, and in the next penetration test scope statement by name. If the scope says “web application and API,” the model server is not in it.
