Analysis of exposed Ollama/LiteLLM AI infra exploited by Strix/HexStrike for autonomous pentesting

Vulnerability Overview Attackers are leveraging AI infrastructure owned by organizations to execute complex threat activities. Specifically, attackers are exploiting exposed application programming interfaces (APIs) in self-hosted AI software. These APIs include the Ollama and endpoints (port 11434), as well as the LiteLLM endpoint (port 4000). Impact Scope Attacker Behavior: Attackers can access AI infrastructure without special authentication through exposed API endpoints. Attacker Tools: Attackers employed a variety of tools, including: - Strix: An autonomous penetration testing framework. - HexStrike AI: Another autonomous penetration testing framework. - OpenAI Codex: An AI model used for code generation. Attack Cases: - Strix: The attacker used the LiteLLM client to send a prompt of 140,000 characters, weaponizing Strix against an unspecified French auction website. - HexStrike AI: The attacker targeted desktop LLM clients, leveraging Ollama instances and penetration testing orchestration services. - OpenAI Codex: The attacker utilized an OpenAI Codex agent, masquerading as a security auditor, to perform web reverse engineering. Remediation Do Not Expose AI Infrastructure: - Do not expose model backends to the internet. - Require real authentication and reject default or placeholder keys. - Inspect request bodies originating from external sources. - Monitor traffic passing through the AI infrastructure. Additional Recommendations: - Use full-agent payloads instead of standard prompts. - Block common request body indicators, such as prompts containing complete tools or requests. - Block requests associated with penetration testing tools or insecure personnel. - Block specific IP addresses used in attacks. Related Code No specific Proof of Concept (PoC) code or exploitation code was provided in the source material. Summary Attackers are exploiting exposed AI infrastructure APIs to conduct complex threat activities, including penetration testing and code generation. To prevent such attacks, organizations should avoid exposing their AI infrastructure and implement strict authentication and monitoring measures.

Goal Reached Thanks to every supporter — we hit 100%!

Analysis of exposed Ollama/LiteLLM AI infra exploited by Strix/HexStrike for autonomous pentesting