Zenity Labs Reveals AI Infrastructure Weaponization

Zenity Labs disclosed research, distributed via Business Wire and detailed on its own labs.zenity.io blog, describing a global network of honeypot sensors that mimic enterprise AI infrastructure. Between March and May 2026, the honeypots caught three distinct operators hijacking exposed, unauthenticated Ollama and LiteLLM inference endpoints as the model backend for their own offensive tooling. Separately, Zenity's sensors recorded hundreds of exploitation attempts targeting CVE-2026-40217, a critical remote-code-execution vulnerability in LiteLLM, beginning the same day the CVE was patched and continuing for six weeks, alongside activity tied to an SSRF variant of CVE-2024-6587 and a coordinated campaign against CVE-2026-35029, since patched by maintainer BerriAI.

The three honeypot incidents each show a distinct pattern. On March 20, one operator sent a 140,000-character prompt containing the full instructions for Strix, a known autonomous AI pentesting agent, directing it at a live third-party target Zenity identified only as "a well established French auction site"; the attack was blocked before completion, though repeated retry commands suggested a human operator actively steering it. A day earlier, a second operator loaded the 150-tool HexStrike AI offensive framework, including nmap, sqlmap, metasploit and Kubernetes attack tools, onto a hijacked Ollama instance, apparently staging capability rather than running a live attack. A third operator pointed an OpenAI Codex agent, identifiable by its user-agent string, at a hijacked LiteLLM proxy secured only by the placeholder key the software ships with, and issued a system-prompt persona called "Senior Web Asset Telemetry and Interoperability Auditor" designed to suppress safety refusals during web reverse-engineering work; a metadata header inadvertently leaked a GitHub handle and repository tied to the operator. Root causes, per Zenity: Ollama has no built-in authentication and commonly gets bound to all network interfaces via a misconfigured environment variable, while LiteLLM's proxy binds to all interfaces by default and only enforces authentication if an operator explicitly sets a master key, leaving many deployments protected by nothing more than the documented placeholder key.

Zenity's core recommendation is to never expose Ollama or LiteLLM directly to the internet: bind them to localhost or a private interface behind an authenticating reverse proxy, reject default or placeholder API keys, and treat unusually large request bodies, oversized tool arrays, or offensive-tool vocabulary in inbound prompts as detectable anomalies, since the entire agent persona and toolset ride in plaintext in each request. Michael Bargury, Zenity's co-founder and CTO, framed the intent behind the research: "We've laid out traps that look and behave like enterprise AI infrastructure and agents, to gain increased visibility into attacker behavior. Attackers spotted our vulnerable AI, exploited n-day vulnerabilities and tried to leverage our AI resources to conduct real-world attacks, tipping their hands and revealing their TTPs." Zenity also published two companion posts describing LiteLLM's guardrail-tester endpoint being used to run code as root and its connection-test endpoint being turned into a key-exfiltration channel.

Zenity says this is "just the first drop, with more findings coming soon," so further disclosures of exposed-AI-backend abuse are likely. Also watch whether CISA or LiteLLM maintainer BerriAI issue further advisories tied to CVE-2026-40217 and CVE-2026-35029, and whether the pattern of using hijacked AI infrastructure as free compute for autonomous offensive agents, rather than simple resource theft, shows up against other self-hosted AI software beyond Ollama and LiteLLM.