# AI Compute Hijacking: Stolen Ollama Server Wired Into Autonomous "VAPT" Exploit Pipeline (Sysdig)

> Sysdig's Threat Research Team captured a threat actor abusing a misconfigured, unauthenticated Ollama model server (port 11434) as the free reasoning engine for an autonomous, multi-stage offensive-security pipeline dubbed VAPT, which fingerprints targets, matches CVEs, synthesizes proof-of-concept exploits (including blind SQLi), extracts secrets, and plans privilege escalation with the model deciding each step. The activity converges classic LLMjacking (stolen AI compute) with autonomous/agentic exploitation, observed across four sessions between June 12-14, 2026 from Indian residential IPs against private lab/benchmark ranges.

- **Published:** 2026-07-02T00:00:00Z
- **Last reviewed:** 2026-07-02T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1076
- **ID:** TL-2026-1076
- **Severity:** HIGH (CVSS 9.1)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 22 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-7482

## Description

On June 12, 2026 at 15:43 UTC, the Sysdig Threat Research Team (led by Michael Clark, Director of Threat Research) observed an 8.5-hour session in which a threat actor drove inference requests against a misconfigured, internet-exposed Ollama model server to power a custom offensive-security automation framework the actor calls "VAPT" (Vulnerability Assessment and Penetration Testing). Unlike prior LLMjacking cases, where stolen model access is resold or used for chat, this actor wired the stolen inference capacity directly into a software pipeline: each pipeline stage sends the model a tightly-scoped instruction and requires a strictly structured (JSON) response so the surrounding orchestration code can consume the output deterministically and drive the next action without human intervention.

Observed VAPT stages included: (1) service fingerprinting that normalizes banner/service data into CPE identities for CVE lookup; (2) vulnerability matching that filters candidate CVEs by product/version; (3) web reconnaissance that extracts paths, parameters, headers and cookies from targets; (4) proof-of-concept exploit synthesis producing protocol-aware exploit code with self-validation; (5) blind SQL-injection payload crafting using time-based techniques with WAF/filter evasion; (6) credential and secret extraction from files retrieved post-compromise; (7) arbitrary file-read target prioritization; (8) privilege-escalation command planning; and (9) an autonomous orchestration/controller stage that strings the prior stages together to attempt end-to-end compromise and confirm remote code execution.

The framework's compromise-confirmation routine wraps command output in the string markers "VAPTb3gin" and "VAPTfin" (e.g., `echo VAPTb3gin; id; echo VAPTfin`) and uses a `__VAPTCMD__` placeholder token for parameterized command injection — reliable, low-noise detection signatures for this and similar agent-driven offensive tooling. A follow-up cluster of three additional sessions totaling roughly 6.5 hours was observed on June 14, 2026 from closely related source IPs, all attributed to the same actor based on shared benchmark target ranges, identical pipeline fingerprints, and consistent Indian residential-ISP origin.

Targeting was limited to the actor's own private/lab infrastructure — a private benchmark network (172.30.0.0/24) and what Sysdig assesses is a HackTheBox penetration-testing lab range (10.129.0.0/16) — with fictitious application names such as "MediaVault Asset Portal" and "Reverb Studio" used as test targets. No production or public-internet victims were confirmed compromised during the observation window; Sysdig characterizes the activity as an actor actively developing and iterating the framework (staged feature additions, rewrites) rather than a mature, at-scale campaign — but warns the trajectory, if it continues, converts commodity stolen AI compute into a scalable, low-cost autonomous intrusion weapon.

The framework is backend-agnostic: captured requests targeted gpt-4o-mini, claude-3-5-sonnet, gemini-2.0-flash-exp, mistral:7b, deepseek-r1:8b, qwen3.5:4b, and an uncensored Llama-3.3-70B-abliterated variant, indicating the actor built the tool to substitute any exposed inference endpoint (paid API key, stolen credential, or open Ollama/LiteLLM server) interchangeably as the reasoning backend.

The exposure surface enabling this class of attack is large: Ollama listens on TCP/11434 without authentication by default, and independent researchers have catalogued roughly 175,000 publicly exposed Ollama instances across 130+ countries — alongside a parallel population of exposed LiteLLM proxy endpoints reachable the same way. Separately and in the same disclosure window, Ollama shipped a fix (acknowledged February 25, 2026, patched in v0.17.1) for CVE-2026-7482 ("Bleeding Llama"), a CVSS 9.1 unauthenticated heap out-of-bounds read in the GGUF model loader (fs/ggml/gguf.go / server/quantization.go WriteTo()) reachable via the /api/create endpoint, allowing an attacker to leak Ollama server process memory — including environment variables, API keys, system prompts, and concurrent users' conversation data — by uploading a crafted GGUF file with an oversized declared tensor offset/size and exfiltrating the resulting artifact via /api/push. While not directly tied to the VAPT actor in Sysdig's telemetry, CVE-2026-7482 demonstrates a second, independent exploitation path against the same exposed-Ollama population (~300,000 servers per Cyera's estimate) that autonomous frameworks like VAPT could plausibly weaponize for further compute theft or data exfiltration.

The Hacker News' July 2, 2026 ThreatsDay Bulletin surfaced the Sysdig research alongside other AI-compute-abuse items (GPT-5.6 Sol zero-day exploitation demos, Anthropic's removal of covert code tracking in Claude Code, and malicious browser extensions impersonating Perplexity AI for search hijacking), framing stolen-AI-compute-as-offensive-infrastructure as an emerging, distinct trend from traditional LLMjacking resale/chat abuse.

## MITRE ATT&CK

- T1595.001 Scanning IP Blocks
- T1592.002 Software
- T1596.005 Scan Databases
- T1588.005 Exploits
- T1584.004 Server
- T1190 Exploit Public-Facing Application
- T1059.004 Unix Shell
- T1203 Exploitation for Client Execution
- T1068 Exploitation for Privilege Escalation
- T1070.003 Clear Command History
- T1027 Obfuscated Files or Information
- T1552.001 Credentials In Files
- T1212 Exploitation for Credential Access
- T1087 Account Discovery
- T1046 Network Service Discovery
- T1082 System Information Discovery
- T1005 Data from Local System
- T1119 Automated Collection
- T1071.001 Web Protocols
- T1567 Exfiltration Over Web Service
- T1496 Resource Hijacking

## Sources

- [ThreatsDay Bulletin: AI Compute Hijacking, Apple ... (Sysdig research on stolen Ollama server)](https://thehackernews.com/2026/07/threatsday-ai-compute-hijacking-apple.html)
- [LLMjacking evolved: Attackers are using stolen AI compute to build offensive agentic tools](https://webflow.sysdig.com/blog/llmjacking-evolved-attackers-are-using-stolen-ai-compute-to-build-offensive-agentic-tools)
- [LLMjacking Evolved: Stolen AI Compute as Offensive Infrastructure](https://labs.cloudsecurityalliance.org/research/csa-research-note-llmjacking-evolved-offensive-agentic-20260/)
- [AI vs AI Cybersecurity: Sysdig Documents First LLM-Agent Intrusion in the Wild](https://www.techtimes.com/articles/317423/20260530/ai-vs-ai-cybersecurity-sysdig-documents-first-llm-agent-intrusion-wild.htm)
- [Attackers Hijack Exposed Ollama and LiteLLM Endpoints to Deploy Autonomous Penetration-Testing Agents](https://windowsnews.ai/article/attackers-hijack-exposed-ollama-and-litellm-endpoints-to-deploy-autonomous-penetration-testing-agent.432985)
- [Ollama Out-of-Bounds Read Vulnerability Allows Remote Process Memory Leak](https://thehackernews.com/2026/05/ollama-out-of-bounds-read-vulnerability.html)
- [Critical Bug Could Expose 300,000 Ollama Deployments to Information Theft](https://www.securityweek.com/critical-bug-could-expose-300000-ollama-deployments-to-information-theft/)
- [Ollama vulnerability CVE-2026-7482: Find impacted assets](https://www.runzero.com/blog/ollama/)
- [CVE-2026-7482 - Ollama heap out-of-bounds read in GGUF tensor parsing leaks server process memory to unauthenticated remote attackers](https://cvefeed.io/vuln/detail/CVE-2026-7482)
- [CVE-2026-7482 (Bleeding Llama) Detection Tools](https://github.com/msuiche/gguf_cve2026_7482)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1076