Threat reportVulnerabilityTL-2026-1076
AI Compute Hijacking: Stolen Ollama Server Wired Into Autonomous "VAPT" Exploit Pipeline (Sysdig)
AI Compute Hijacking (TL-2026-1076), also tracked as LLMjacking Evolved, is a high-severity software vulnerability scored CVSS 9.1, first published 2026-07-02. It is linked to a India-nexus actor with low confidence, affects Ollama Ollama model server, references 1 CVE (CVE-2026-7482), maps to 21 MITRE ATT&CK techniques (T1005, T1027, T1046), and is covered by 9 detection rules and 22 indicators of compromise.
- CVSS
- 9.1/10High
- CVEs
- 1Referenced vulnerabilities
- Techniques
- 21MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 22Indicators of compromise
Key facts for TL-2026-1076
- Threat ID
- TL-2026-1076
- Also known as
- LLMjacking Evolved, VAPT Framework, Bleeding Llama (related exposure)
- Severity
- HIGH
- CVSS
- 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Nation-state nexus
- India
- Motivation
- UNKNOWN
- Target sectors
- unknown - private lab targets only observed
- Target regions
- Global (via exposed Ollama/LiteLLM instances across 130+ countries)
- Detection rules
- 9
- Indicators of compromise
- 22
Malware and tooling in AI Compute Hijacking
Malware and tooling: Llama-3.3-70B-abliterated, VAPT framework, claude-3-5-sonnet, deepseek-r1:8b, gemini-2.0-flash-exp, gpt-4o-mini, mistral:7b, qwen3.5:4b
How AI Compute Hijacking works
Sysdig's Threat Research Team captured a threat actor abusing a misconfigured, unauthenticated Ollama model server (port 11434) as the free reasoning engine for an autonomous, multi-stage offensive-security pipeline dubbed VAPT, which fingerprints targets, matches CVEs, synthesizes proof-of-concept exploits (including blind SQLi), extracts secrets, and plans privilege escalation with the model deciding each step. The activity converges classic LLMjacking (stolen AI compute) with autonomous/agentic exploitation, observed across four sessions between June 12-14, 2026 from Indian residential IPs against private lab/benchmark ranges.
On June 12, 2026 at 15:43 UTC, the Sysdig Threat Research Team (led by Michael Clark, Director of Threat Research) observed an 8.5-hour session in which a threat actor drove inference requests against a misconfigured, internet-exposed Ollama model server to power a custom offensive-security automation framework the actor calls "VAPT" (Vulnerability Assessment and Penetration Testing). Unlike prior LLMjacking cases, where stolen model access is resold or used for chat, this actor wired the stolen inference capacity directly into a software pipeline: each pipeline stage sends the model a tightly-scoped instruction and requires a strictly structured (JSON) response so the surrounding orchestration code can consume the output deterministically and drive the next action without human intervention.
Observed VAPT stages included: (1) service fingerprinting that normalizes banner/service data into CPE identities for CVE lookup; (2) vulnerability matching that filters candidate CVEs by product/version; (3) web reconnaissance that extracts paths, parameters, headers and cookies from targets; (4) proof-of-concept exploit synthesis producing protocol-aware exploit code with self-validation; (5) blind SQL-injection payload crafting using time-based techniques with WAF/filter evasion; (6) credential and secret extraction from files retrieved post-compromise; (7) arbitrary file-read target prioritization; (8) privilege-escalation command planning; and (9) an autonomous orchestration/controller stage that strings the prior stages together to attempt end-to-end compromise and confirm remote code execution.
The framework's compromise-confirmation routine wraps command output in the string markers "VAPTb3gin" and "VAPTfin" (e.g., `echo VAPTb3gin; id; echo VAPTfin`) and uses a `__VAPTCMD__` placeholder token for parameterized command injection — reliable, low-noise detection signatures for this and similar agent-driven offensive tooling. A follow-up cluster of three additional sessions totaling roughly 6.5 hours was observed on June 14, 2026 from closely related source IPs, all attributed to the same actor based on shared benchmark target ranges, identical pipeline fingerprints, and consistent Indian residential-ISP origin.
Targeting was limited to the actor's own private/lab infrastructure — a private benchmark network (172.30.0.0/24) and what Sysdig assesses is a HackTheBox penetration-testing lab range (10.129.0.0/16) — with fictitious application names such as "MediaVault Asset Portal" and "Reverb Studio" used as test targets. No production or public-internet victims were confirmed compromised during the observation window; Sysdig characterizes the activity as an actor actively developing and iterating the framework (staged feature additions, rewrites) rather than a mature, at-scale campaign — but warns the trajectory, if it continues, converts commodity stolen AI compute into a scalable, low-cost autonomous intrusion weapon.
The framework is backend-agnostic: captured requests targeted gpt-4o-mini, claude-3-5-sonnet, gemini-2.0-flash-exp, mistral:7b, deepseek-r1:8b, qwen3.5:4b, and an uncensored Llama-3.3-70B-abliterated variant, indicating the actor built the tool to substitute any exposed inference endpoint (paid API key, stolen credential, or open Ollama/LiteLLM server) interchangeably as the reasoning backend.
The exposure surface enabling this class of attack is large: Ollama listens on TCP/11434 without authentication by default, and independent researchers have catalogued roughly 175,000 publicly exposed Ollama instances across 130+ countries — alongside a parallel population of exposed LiteLLM proxy endpoints reachable the same way. Separately and in the same disclosure window, Ollama shipped a fix (acknowledged February 25, 2026, patched in v0.17.1) for CVE-2026-7482 ("Bleeding Llama"), a CVSS 9.1 unauthenticated heap out-of-bounds read in the GGUF model loader (fs/ggml/gguf.go / server/quantization.go WriteTo()) reachable via the /api/create endpoint, allowing an attacker to leak Ollama server process memory — including environment variables, API keys, system prompts, and concurrent users' conversation data — by uploading a crafted GGUF file with an oversized declared tensor offset/size and exfiltrating the resulting artifact via /api/push. While not directly tied to the VAPT actor in Sysdig's telemetry, CVE-2026-7482 demonstrates a second, independent exploitation path against the same exposed-Ollama population (~300,000 servers per Cyera's estimate) that autonomous frameworks like VAPT could plausibly weaponize for further compute theft or data exfiltration.
The Hacker News' July 2, 2026 ThreatsDay Bulletin surfaced the Sysdig research alongside other AI-compute-abuse items (GPT-5.6 Sol zero-day exploitation demos, Anthropic's removal of covert code tracking in Claude Code, and malicious browser extensions impersonating Perplexity AI for search hijacking), framing stolen-AI-compute-as-offensive-infrastructure as an emerging, distinct trend from traditional LLMjacking resale/chat abuse.
MITRE ATT&CK techniques used in TL-2026-1076
Collection
T1005 Data from Local System; T1119 Automated Collection
Defense Evasion
T1027 Obfuscated Files or Information; T1070.003 Clear Command History
Discovery
T1046 Network Service Discovery; T1082 System Information Discovery; T1087 Account Discovery
Execution
T1059.004 Unix Shell; T1203 Exploitation for Client Execution
Privilege Escalation
T1068 Exploitation for Privilege Escalation
Command and Control
Initial Access
T1190 Exploit Public-Facing Application
Credential Access
T1212 Exploitation for Credential Access; T1552.001 Credentials In Files
Impact
Exfiltration
T1567 Exfiltration Over Web Service
Resource Development
T1584.004 Server; T1588.005 Exploits
Reconnaissance
T1592.002 Software; T1595.001 Scanning IP Blocks; T1596.005 Scan Databases
Affected products and versions in AI Compute Hijacking
- Ollama — Ollama model server
Vulnerable versions: all versions with default/no-auth binding on port 11434; < 0.17.1 (CVE-2026-7482)
Fixed in: 0.17.1+ for CVE-2026-7482; authenticated/localhost-bound deployments for exposure abuse - LiteLLM — LiteLLM proxy
Vulnerable versions: unauthenticated/misconfigured internet-exposed deployments
Fixed in: N/A - deployment misconfiguration, not a code vulnerability
Remediation for AI Compute Hijacking
Patches
- Ollama 0.17.1+ (fixes CVE-2026-7482 GGUF tensor parsing heap out-of-bounds read)
Immediate actions
- Bind Ollama to localhost/loopback only; block inbound TCP/11434 at the perimeter and host firewall
- Upgrade Ollama to version 0.17.1 or later to remediate CVE-2026-7482 (Bleeding Llama)
- Audit internal and external networks for exposed port 11434 (and exposed LiteLLM proxy ports) via active scanning
- Rotate any API keys or credentials that may have transited an exposed Ollama/LiteLLM instance
Workarounds
- Disable or firewall the /api/create and /api/push endpoints on internet-facing Ollama deployments if upgrade is not immediately possible
- Place any necessarily-exposed inference endpoint behind a network-level allowlist/VPN
Longer-term hardening
- Enforce authentication (OAuth2/OIDC with short-lived tokens, or a reverse-proxy auth layer) in front of all self-hosted LLM inference endpoints
- Treat exposed model servers as equivalent in risk to exposed databases in asset-inventory and exposure-management programs
- Deploy monitoring for anomalous inference volume, structured JSON tool-calling output patterns, and programmatic error-recovery sequences characteristic of agentic offensive pipelines
- Alert on API/inference cost anomalies inconsistent with organizational usage baselines
CVEs associated with AI Compute Hijacking
Weaknesses (CWE) in AI Compute Hijacking
Timeline of AI Compute Hijacking
- Ollama maintainers acknowledge and share a fix for CVE-2026-7482 (Bleeding Llama) heap out-of-bounds read in GGUF tensor parsing
- Sysdig Threat Research Team captures the documented VAPT-framework intrusion later discussed publicly by Michael Clark
- CVE-2026-7482 (Bleeding Llama, CVSS 9.1) publicly disclosed, affecting an estimated 300,000 Ollama servers; patched in v0.17.1
- Security Magazine publishes an interview with Sysdig Director of Threat Research Michael Clark discussing the captured intrusion
- Initial 8.5-hour VAPT pipeline session observed beginning 15:43 UTC from source IP 122.183.48.82 (Hyderabad residential ISP)
- Three additional VAPT sessions totaling ~6.5 hours observed from related source IPs (122.183.48.35, 122.183.48.195, 47.15.69.15), attributed to the same actor
- Sysdig publishes "LLMjacking evolved: Attackers are using stolen AI compute to build offensive agentic tools", detailing the VAPT framework and detection markers
- The Hacker News' ThreatsDay Bulletin surfaces the Sysdig research alongside other AI-compute-abuse trends
Sources cited for AI Compute Hijacking
- ThreatsDay Bulletin: AI Compute Hijacking, Apple ... (Sysdig research on stolen Ollama server)
- LLMjacking evolved: Attackers are using stolen AI compute to build offensive agentic tools
- LLMjacking Evolved: Stolen AI Compute as Offensive Infrastructure
- AI vs AI Cybersecurity: Sysdig Documents First LLM-Agent Intrusion in the Wild
- Attackers Hijack Exposed Ollama and LiteLLM Endpoints to Deploy Autonomous Penetration-Testing Agents
- Ollama Out-of-Bounds Read Vulnerability Allows Remote Process Memory Leak
- Critical Bug Could Expose 300,000 Ollama Deployments to Information Theft
- Ollama vulnerability CVE-2026-7482: Find impacted assets
- CVE-2026-7482 - Ollama heap out-of-bounds read in GGUF tensor parsing leaks server process memory to unauthenticated remote attackers
- CVE-2026-7482 (Bleeding Llama) Detection Tools
Detection coverage for TL-2026-1076
As of 2026-07-02, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1076 across Splunk SPL, Microsoft KQL and Sigma, covering 22 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.