The Self-Expanding Stolen Inference Supply Chain: An AI Agent Harvesting and Re-Serving LLM Access, (Fri, Sep 11th)

SANS Internet Storm Center digest highlighting active exploitation and vulnerability activity, including an attacker-operated semi-autonomous AI agent harvesting and aggregating LLM inference access, scanning for vulnerable Proxmox VE servers, a record Microsoft Patch Tuesday with 973 fixes and two exploited vulnerabilities, and an actively exploited MikroTik SSH authentication-bypass vulnerability with attackers creating persistent accounts. The most urgent items concern exploited edge/network-device vulnerabilities and compromise persistence.