SANS ISC: Honeypot Hijacked to Impersonate a "Free" LLM Backend, Captured a Live Coding-Agent Session

A SANS Internet Storm Center researcher reported that one of their internet-exposed LLM inference honeypots was discovered, relabeled with sought-after model names, and folded into infrastructure being used to offer "free" LLM backends to unsuspecting users.

What happened

According to the ISC diary, the honeypot subsequently received a genuine coding-agent session pointed at it. That interaction exposed the agent's conversation history, filesystem output, working paths, and its local tool manifest. The researcher notes the honeypot itself never requested or triggered any tool execution — the point is what a malicious operator in that position could have done with the information and access the agent handed over.

Why it matters for defenders

Coding agents that connect to "free" or third-party-hosted LLM endpoints are effectively trusting that endpoint with a great deal of sensitive context: file paths, code contents, and the tool-calling interface itself. If that endpoint is adversary-controlled — whether via a hijacked honeypot, a rebranded proxy, or a deliberately malicious "free tier" — the operator sits in a position to harvest source code and environment details, and potentially to attempt prompt injection against the agent to influence which tools it calls next. This is relevant to any organization or individual whose developers or automation route coding-agent traffic through unverified or non-first-party inference endpoints.

What defenders should watch for

• Inventory which LLM/inference endpoints coding agents and developer tooling are configured to use, and flag any that aren't a trusted first-party or vetted vendor.
• Treat unauthenticated or unusually "free" third-party model endpoints as untrusted infrastructure — assume anything sent to them (code, paths, history) can be logged or abused.
• Watch for coding-agent or developer egress to unfamiliar inference hosts/IPs, especially ones not matching known model-provider domains.
• Review agent tool-manifest and execution logs for signs that responses from an external model influenced unexpected tool calls (a hallmark of prompt-injection abuse).
• Restrict or gate what filesystem/tool access a coding agent has when its model backend cannot be fully trusted.

Developing intel

This is a single honeypot researcher's report rather than a confirmed widespread campaign, and SANS ISC does not attribute it to a specific threat actor or name victims. Details may evolve as more data comes in. Read the original diary at isc.sans.edu.