Cyberattacks Target Large Language Model Infrastructure
Security researchers identified over 91,000 attack sessions targeting large language model infrastructure between October 2025 and January 2026, comprising two campaigns: one exploiting server-side request forgery vulnerabilities in Ollama and a second conducting systematic reconnaissance of LLM endpoints including OpenAI, Anthropic, and other providers to identify misconfigured proxies and enumerate API access.", <parameter name="event_date">2025-10-01
What happened
GreyNoise's Ollama honeypot infrastructure captured 91,403 attack sessions targeting AI infrastructure between October 2025 and January 2026, revealing two distinct threat campaigns.
The first campaign, running from October 2025 through January 2026 with a spike over Christmas, exploited server-side request forgery vulnerabilities to force servers into making outbound connections to attacker-controlled infrastructure. Attackers manipulated Ollama's model pull functionality by injecting malicious registry URLs and Twilio SMS webhook parameters.
A second campaign starting December 28, 2025 conducted methodical probes of 73+ LLM model endpoints, generating 80,469 sessions in eleven days. The reconnaissance targeted OpenAI GPT-4o, Anthropic Claude, Meta Llama 3.x, DeepSeek-R1, Google Gemini, Mistral, Alibaba Qwen, and xAI Grok with test queries like 'hi' and factual questions, likely aiming to fingerprint models and identify misconfigured proxy servers exposing access to commercial APIs.
Reported impact
The attacks sought to identify misconfigured proxy servers that might expose access to commercial APIs and to fingerprint exposed LLM model endpoints.
Index analysis
While 62 source IPs spread across 27 countries were observed in the first campaign, consistent fingerprints suggest VPS-based infrastructure rather than a botnet. GreyNoise assesses the first campaign as probable grey-hat operations by bug bounty hunters, though the scale and timing raise ethical concerns.
The second campaign infrastructure points to professional threat actors: two IPs with extensive histories of CVE exploitation, generating 49,955 and 30,514 sessions respectively.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.