AI Coding Agent Used to Harvest and Resell Stolen LLM Access, SANS ISC Reports

A SANS Internet Storm Center diary published on September 11, 2026 describes an attacker using a semi-autonomous coding agent to run an offensive operation against LLM resale infrastructure. According to the report, the agent located poorly secured LLM resale gateways, obtained API access through common web application flaws and account farming, validated the stolen inference capacity, and consolidated it behind a gateway of the attacker's own.

Why It Matters

This describes a supply chain for stolen LLM access: compromised credentials and API keys feeding into an aggregation point that can be resold or reused at scale. Organizations running LLM resale gateways, API proxies, or any service that brokers access to inference capacity are potential targets, both as victims whose access is stolen and as unwitting infrastructure abused to launder that access. The use of a coding agent to automate discovery, exploitation, and validation also signals that this kind of low-effort web-flaw hunting and credential harvesting can now be run with less manual attacker effort than before.

What Defenders Should Watch For

• Review authentication and authorization on any LLM gateway, API proxy, or resale service for common web flaws (broken access control, weak or reused API keys, missing rate limiting).
• Watch for account farming patterns: bursts of new account creation, especially from automated or scripted sources, followed by rapid API key generation.
• Monitor for anomalous inference usage patterns on LLM API keys, such as sudden spikes in call volume, requests from unexpected source IPs or geographies, or usage inconsistent with the account's normal behavior.
• Look for automated, high-velocity probing of authentication and billing endpoints, which may indicate an agent-driven reconnaissance and validation loop rather than manual attacker activity.
• Rotate and scope API keys tightly, and enforce strong, monitored authentication on any gateway that brokers third-party LLM access.

This is developing, net-new threat intelligence based on a single researcher's observations, and further details on scope, actors, and affected services may emerge. For the full technical write-up, see the original SANS ISC diary at https://isc.sans.edu/diary/rss/33332.