# An Agent Built a Stolen LLM Pool. Then It Briefed a Honeypot. > SANS published a honeypot capture on 11 September of a coding agent that harvested poorly secured LLM resale gateways and aggregated working access behind a New-API instance. Of 379 loaded channels, 341 failed. Stormcast led with the case on 14 September. A human still steered it. The agent sent about 43 KB of its own playbook to the honeypot. Source: https://hackerlogs.com/blog/stolen-llm-inference-gateway Published: 2026-09-14 ## Key takeaways - This is not the GTIG six-hour credential harvest. The commodity here is inference capacity: stolen resale keys, validated, then served again through one gateway. - The operator loaded about 379 upstream channels into a self-hosted New-API instance. A logic test disabled 341 as fake or dead. Five model names then answered through one endpoint. - SANS is explicit: a human still steered the loop. The data does not show a fully autonomous or self-replicating system. - The agent picked the researcher's OpenAI-compatible honeypot as a free backend and sent about 43 KB of AGENTS.md, keys, scripts, and prior targets with the request. - If you run a cheap or untrusted LLM proxy, treat it as a destination for agent context, not just a token meter. [SANS Stormcast](https://isc.sans.edu/podcastdetail/10092) opened Monday with a stolen LLM gateway. The write-up is [Renato Marinho's 11 September diary](https://isc.sans.edu/diary/33332): a coding agent that found poorly secured resale panels, farmed access, tested whether the keys actually inferred, and poured the survivors into one gateway. Google Trends US this morning was Gloria Steinem and football. This is the operator story that moved on the security side of X. This is not a rewrite of the [six-hour harvest](/blog/gtig-six-hour-harvest). That clock starts after a cloud foothold and ends in third-party credentials. The commodity here is inference. Semi-autonomous harvesting of LLM resale access, then re-serving it through a unified API. High because the pool came online, not because the agent ran unsupervised. Three panels for the SANS stolen-inference capture: 379 channels loaded into New-API with 341 failing a logic test, a human-steered loop that turns stolen keys into a failover pool, and a honeypot that received about 43 KB of the agent's own playbook. ## What the honeypot actually caught. Marinho's trap emulates an OpenAI-compatible endpoint. The operator's agent treated it as free backend. Because this client stuffed operating instructions into the model request, the honeypot received about 43 KB of material: a large instructions file, an offensive playbook, infrastructure notes, reconnaissance scripts, collected API keys, previous targets, and parts of the agent's working history. The agent mailed a slice of its own control plane to a stranger. One instruction told it to confirm a proxy was up before it continued. That check compared the live egress against a reference IP in the playbook. The comparison leaked the operator's direct, unproxied address. > Keys are the intermediate asset. The diary's point is the loop after collection: validate usable inference, drop the fakes, map surviving channels onto familiar model names, and serve the pool through one endpoint with failover. That is a supply chain, not a cred dump. A later session showed the aggregation being built, not only described. The operator stood up a self-hosted New-API instance, a legitimate open-source gateway. They loaded about 379 upstream endpoints as channels. A small factorial test, meant to separate live models from canned replies, disabled 341 as fake or dead. Five advertised names (DeepSeek, Claude, GPT, Gemini, GLM) were mapped onto the survivors with priority round-robin and automatic failover. A final probe got usable answers for all five through the single endpoint. When the panel's own rate limits blocked the automation, the agent edited the gateway's local database and injected an admin token. We are not reprinting that edit. The operator fact is enough: if the control plane is a SQLite file the agent can reach, the panel is not the authority. ## Why SANS calls it only partly self-expanding. Classic [LLMjacking](https://www.sysdig.com/blog/llmjacking-evolved-attackers-are-using-stolen-ai-compute-to-build-offensive-agentic-tools), as Sysdig named it in 2024 and updated in June, is stolen access powering offensive tooling. The arrow points one way: stolen inference, then the tool. This capture adds a return path. The agent helps acquire the next tranche of access, validates it, and pours it back into the pool the agent later draws on. Marinho's line is careful: partially self-expanding, because a human still steers. The data does not show a fully autonomous or self-replicating system. That matches [GTIG's Q2 tracker](/blog/gtig-six-hour-harvest). Google has not seen fully autonomous attack pipelines against targets in the wild. Speed is the change. Unsupervised war is not. > A reseller label is a claim. The diary is explicit: a working model behind an endpoint that advertises Claude or GPT is the reseller's sticker, not a verified identity. Hunt the pool. Do not assume the name on the channel is the vendor. ## What this is not. It is not a named CVE. There is nothing to patch by number. The playbook looked for ordinary web flaws on resale panels: open registration with a starting balance, default credentials, authorization that trusted a client-supplied group field, and catalogs that answered without a login. Those are configuration failures, executed now by an agent instead of a person. It is not New-API as malware. The project is a normal gateway. The abuse is what got loaded into it. It is also not proof that cheap proxies are always hostile. It is proof that an untrusted OpenAI-compatible endpoint sits in a privileged place. Whatever your coding agent wraps around a prompt (instructions, filenames, keys, command output) can leave with the request. In this case it did. ## What to do. If you operate an LLM resale gateway, a subscription panel, or a coding-agent fleet: 1. Close the conditions the playbook was shopping for. No open registration with a free balance. No default credentials. No unauthenticated model or account listing. No authorization decision that trusts a field the client sent. 2. Cap default billing. Extremely high limits were part of what made a stolen key worth keeping. 3. Treat a sudden flood of trial accounts, temporary-mail signups, and one-shot factorial or file-edit probes as reconnaissance against the panel, not as curious users. 4. Point coding agents at endpoints you operate or have a contract with. A suspiciously cheap proxy is a destination for agent context. The token price is not the loss. 5. If you already used an unknown OpenAI-compatible host, rotate every key the agent could have pasted into a prompt, and assume instructions files went with it. The Monday podcast is how this left the diary and hit the timeline. The working rule is older than the show: if your agent can reach a model host you do not run, you are already sending it more than a prompt. This operator learned that the expensive way. The honeypot learned it for free. ## Sources - [The Self-Expanding Stolen Inference Supply Chain: An AI Agent Harvesting and Re-Serving LLM Access](https://isc.sans.edu/diary/33332) (2026-09-11) - [SANS Stormcast Monday, September 14th, 2026](https://isc.sans.edu/podcastdetail/10092) (2026-09-14) - [LLMjacking evolved: Attackers are using stolen AI compute to build offensive agentic tools](https://www.sysdig.com/blog/llmjacking-evolved-attackers-are-using-stolen-ai-compute-to-build-offensive-agentic-tools) (2026-06-12) - [GTIG AI Threat Tracker: From Prompting to Autonomy](https://cloud.google.com/blog/topics/threat-intelligence/from-prompting-to-autonomy-the-evolution-of-adversarial-ai) (2026-09-08)