Non-browser process making outbound calls to public LLM inference APIs

Ibrahim Saud@tektrix

•updated 11 days ago•0•0•1

Detects network connections to common public LLM inference APIs (OpenAI, HuggingFace, Anthropic, etc.) originating from processes other than standard web browsers or authorized developer tools. This behavior may indicate an attempt to exfiltrate data, utilize remote compute, or perform automated C2 communication via public generative AI services.