The Self-Expanding Stolen Inference Supply Chain: An AI Agent Harvesting and Re-Serving LLM Access, (Fri, Sep 11th)

SANS Internet Storm Center entries report an emerging semi-autonomous operation that harvests LLM inference capacity through exposed resale gateways, web flaws, and account farming, then aggregates access behind an attacker-controlled gateway. The feed also highlights active exploitation of an SSH authentication-bypass vulnerability in MikroTik devices, legacy Proxmox VE scanning, and a record Microsoft Patch Tuesday with vulnerabilities exploited in the wild. No specific CVE identifiers are provided in the supplied document.