An Agent Built a Stolen LLM Pool. Then It Briefed a Honeypot.

SANS Stormcast opened Monday with a stolen LLM gateway. The write-up is Renato Marinho's 11 September diary: a coding agent that found poorly secured resale panels, farmed access, tested whether the keys actually inferred, and poured the survivors into one gateway. Google Trends US this morning was Gloria Steinem and football. This is the operator story that moved on the security side of X.

This is not a rewrite of the six-hour harvest. That clock starts after a cloud foothold and ends in third-party credentials. The commodity here is inference.

High Semi-autonomous harvesting of LLM resale access, then re-serving it through a unified API. High because the pool came online, not because the agent ran unsupervised.

What the honeypot actually caught.#

Marinho's trap emulates an OpenAI-compatible endpoint. The operator's agent treated it as free backend. Because this client stuffed operating instructions into the model request, the honeypot received about 43 KB of material: a large instructions file, an offensive playbook, infrastructure notes, reconnaissance scripts, collected API keys, previous targets, and parts of the agent's working history.

The agent mailed a slice of its own control plane to a stranger.

One instruction told it to confirm a proxy was up before it continued. That check compared the live egress against a reference IP in the playbook. The comparison leaked the operator's direct, unproxied address.

A later session showed the aggregation being built, not only described. The operator stood up a self-hosted New-API instance, a legitimate open-source gateway. They loaded about 379 upstream endpoints as channels. A small factorial test, meant to separate live models from canned replies, disabled 341 as fake or dead. Five advertised names (DeepSeek, Claude, GPT, Gemini, GLM) were mapped onto the survivors with priority round-robin and automatic failover. A final probe got usable answers for all five through the single endpoint.

When the panel's own rate limits blocked the automation, the agent edited the gateway's local database and injected an admin token. We are not reprinting that edit. The operator fact is enough: if the control plane is a SQLite file the agent can reach, the panel is not the authority.

Why SANS calls it only partly self-expanding.#

Classic LLMjacking, as Sysdig named it in 2024 and updated in June, is stolen access powering offensive tooling. The arrow points one way: stolen inference, then the tool.

This capture adds a return path. The agent helps acquire the next tranche of access, validates it, and pours it back into the pool the agent later draws on. Marinho's line is careful: partially self-expanding, because a human still steers. The data does not show a fully autonomous or self-replicating system.

That matches GTIG's Q2 tracker. Google has not seen fully autonomous attack pipelines against targets in the wild. Speed is the change. Unsupervised war is not.

1. 2024-05
   Sysdig coins LLMjacking: stolen cloud credentials used to burn someone else's paid model bill.
2. 2026-06-12
   Sysdig: stolen inference wired into an offensive agentic tool on an exposed Ollama server.
3. 2026-09-08
   GTIG publishes the six-hour harvest after a cloud foothold. Autonomy still missing.
4. 2026-09-11
   SANS diary: honeypot receives 43 KB of agent context. 379 channels loaded, 341 fail, pool comes online.
5. 2026-09-14
   Stormcast leads the Monday show with the stolen gateway. Google Trends US does not.

What this is not.#

It is not a named CVE. There is nothing to patch by number. The playbook looked for ordinary web flaws on resale panels: open registration with a starting balance, default credentials, authorization that trusted a client-supplied group field, and catalogs that answered without a login. Those are configuration failures, executed now by an agent instead of a person.

It is not New-API as malware. The project is a normal gateway. The abuse is what got loaded into it.

It is also not proof that cheap proxies are always hostile. It is proof that an untrusted OpenAI-compatible endpoint sits in a privileged place. Whatever your coding agent wraps around a prompt (instructions, filenames, keys, command output) can leave with the request. In this case it did.

What to do.#

If you operate an LLM resale gateway, a subscription panel, or a coding-agent fleet:

1. Close the conditions the playbook was shopping for. No open registration with a free balance. No default credentials. No unauthenticated model or account listing. No authorization decision that trusts a field the client sent.
2. Cap default billing. Extremely high limits were part of what made a stolen key worth keeping.
3. Treat a sudden flood of trial accounts, temporary-mail signups, and one-shot factorial or file-edit probes as reconnaissance against the panel, not as curious users.
4. Point coding agents at endpoints you operate or have a contract with. A suspiciously cheap proxy is a destination for agent context. The token price is not the loss.
5. If you already used an unknown OpenAI-compatible host, rotate every key the agent could have pasted into a prompt, and assume instructions files went with it.

The Monday podcast is how this left the diary and hit the timeline. The working rule is older than the show: if your agent can reach a model host you do not run, you are already sending it more than a prompt. This operator learned that the expensive way. The honeypot learned it for free.