Attackers are hijacking exposed AI endpoints to run offensive operations. No exploit needed.

The attack doesn't require a compromise

There's a new attack pattern getting documented that every team running self-hosted AI infrastructure should know about.

Between March and May 2026, researchers at Zenity observed three separate campaigns where attackers used exposed LLM endpoints as compute for their own offensive AI operations. Not by exploiting a vulnerability.Not by compromising credentials. Just by knowing where the endpoint was and sending it requests.

The targets were Ollama and LiteLLM instances, two of the most common tools for self-hosting LLMs. The attack is embarrassingly simple: find an exposed endpoint, point your AI agent at it, and use someone else's infrastructure to power your operations.

Why this works