Overview
A security researcher operating an internet-exposed LLM inference honeypot observed it being discovered by scanners, relabeled with sought-after model identifiers (including a DeepSeek-style name), and incorporated into infrastructure advertising ‘free’ LLM API access. On 2026-08-30, the honeypot received a genuine coding-agent session from an ordinary user — 210 identical 224 KB requests in 91 seconds — containing 88 messages of conversation history, tool outputs, filesystem listings, a Windows username, and portions of private files the agent had already read. The relay originated from a China Unicom address in Hebei. The incident illustrates a new class of threat: the rogue model endpoint, where a counterfeit reasoning backend positions itself as a trusted control-plane component for tool-enabled agents.
Technical Analysis
The user was running opencode, an open-source terminal coding agent, configured to use a backend labeled "model": "fofa-ds-NNNNN" — consistent with a DeepSeek-compatible endpoint discovered via FOFA or a similar scanner. The agent connected with Authorization: Bearer free, which the honeypot did not validate.
By the time the session reached the honeypot, the agent had already:
- Listed the user’s Downloads directory
- Copied files to
%TEMP%and unpacked them - Written and executed a Python extraction script via PowerShell tool calls
- Read chapters of the target novels
All of this context — the tool manifest, working paths, file content, and shell history — arrived in the single request payload when the user typed ‘continue’. A malicious operator at that endpoint position could have responded with a crafted tool-call instruction (e.g., a shell or file_write call), which the agent, depending on its configuration, may have executed automatically without user confirmation. This is not prompt injection through user-supplied content — it is backend response manipulation against an agent that implicitly trusts its configured reasoning endpoint.
The attack model is analogous to an evil twin Wi-Fi access point but for AI inference: advertise a desirable, free service; wait for tool-enabled agents to connect; respond with adversarial tool-call payloads.
Framework Mapping
- AML.T0080 (AI Agent Context Poisoning) and AML.T0110 (AI Agent Tool Poisoning): A malicious response could poison agent behaviour or direct tool invocation.
- AML.T0086 (Exfiltration via AI Agent Tool Invocation): The agent’s own file-read tools could be turned against the user.
- AML.T0057 (LLM Data Leakage) and AML.T0084 (Discover AI Agent Configuration): Full session context including tool manifests was passively received.
- LLM08 (Excessive Agency): Agents executing tool calls without verifying endpoint trustworthiness epitomises excessive agency risk.
- LLM05 (Supply Chain Vulnerabilities): The ‘free backend’ supply chain is the attack surface.
Impact Assessment
Any developer or researcher using a tool-enabled coding agent pointed at an unverified LLM backend is at risk. The threat is not limited to credential theft — a well-positioned rogue endpoint could direct file reads, writes, or shell execution on the connecting machine. The passive data exposure alone (filesystem layout, usernames, file contents) represents a significant privacy and operational security breach even without active exploitation.
Mitigation & Recommendations
- Enforce backend allowlists: Only permit AI agents to connect to endpoints with verified TLS certificates and known, trusted operators.
- Apply least-privilege tool configuration: Disable or sandbox file-write and shell tools when not strictly required; require explicit human confirmation before any tool execution.
- Treat the inference endpoint as part of your trust boundary: Audit agent configurations as you would any network credential or API key.
- Avoid ‘free’ unofficial LLM relays: The cost savings are not worth ceding control-plane access to an unknown operator.
- Log and monitor outbound agent requests: Anomalous repetition (210 requests in 91 seconds) is a detectable signal.