Executive Summary
Sysdig researchers have identified a convergence of compute theft and autonomous offensive AI tooling in a campaign dubbed 'LLMjacking.' Attackers are leveraging misconfigured, internet-facing Ollama model servers to power an automated hacking pipeline called VAPT. This framework uses stolen AI compute to conduct multi-stage attacks, including vulnerability mapping, SQL injection payload crafting, and privilege escalation.
The VAPT framework is highly structured, requiring the hijacked AI models to provide specific outputs that can be consumed by an orchestrator for hands-off execution. While current activity has been observed primarily against private lab environments like HackTheBox, the scale of exposure is significant, with approximately 175,000 publicly accessible Ollama instances vulnerable due to a lack of default authentication on port 11434.
This development marks an evolution from simple token theft to the creation of self-directed, agentic attack tools. Organizations must prioritize securing AI infrastructure to prevent their resources from being weaponized against others or used to facilitate low-cost, high-speed automated exploitation.