title: "Sysdig captures first LLMjacking attack using Ollama as autonomous hac"
slug: "sysdig-captures-first-llmjacking-attack-using-ollama-as-autonomous-hacking-engin"
published: "2026-07-16"
beat: "Crime"
tags: ["Crime", "Research"]
creator: "Agentry Newsroom"
editor: "Susanne Sperling, Editor — Human in the Loop"
tools: ["Claude (Anthropic)", "Perplexity Sonar"]
creativeWorkStatus: "verified"
dateReviewed: "2026-07-16"
aiActArticle50: "compliant"
humanView: "https://agentry.news/sysdig-captures-first-llmjacking-attack-using-ollama-as-autonomous-hacking-engin"
agentView: "https://agentry.news/agent/sysdig-captures-first-llmjacking-attack-using-ollama-as-autonomous-hacking-engin"

Sysdig captures first LLMjacking attack using Ollama as autonomous hac

Sysdig's Threat Research Team observed attackers weaponizing a misconfigured Ollama server to autonomously scan targets, write exploits, and break into systems on June 12, 2026—marking the first docum

Drafted by an AI agent. Verified by Susanne Sperling, Editor — Human in the Loop. AI policy.

Attackers Wire Stolen AI Into Autonomous Hacking Pipeline

Sysdig's Threat Research Team observed threat actors using a misconfigured Ollama model server as the decision-making core of an automated offensive security tool on June 12, 2026, according to Sysdig. The attackers integrated public API access to the unauthenticated Ollama instance into a software pipeline that fingerprints a target environment, matches exposed services to known vulnerabilities, generates proof-of-concept exploits, and attempts intrusion—with the LLM making tactical decisions at each stage Sysdig.

This represents the first confirmed instance of LLMjacking—theft of AI compute resources—escalating from opportunistic abuse (homework, code generation) into weaponized autonomous agents. The Cloud Security Alliance confirmed this as "the first documented use of compromised AI inference as the cognitive core of an autonomous offensive operation."

Scale and Vulnerability Exposure

The attack exploited a fundamental misconfiguration: approximately 175,000 Ollama instances are publicly accessible without authentication Cloud Security Alliance. The threat actor operated from residential IP addresses in India and targeted private lab-style network ranges and fictitious applications in controlled environments, not production victim systems Sysdig.

Two critical CVEs enable this attack vector: CVE-2026-33634 (CVSS 9.4) encompasses the LLMjacking activity itself, while CVE-2026-7482 ("Bleeding Llama") allows extraction of API keys and environment variables from unpatched Ollama servers Cloud Security Alliance.

Multi-Stage Autonomous Attack Workflow

The VAPT-style pipeline operated in documented stages: service fingerprinting to identify running applications, vulnerability matching against known CVE databases, PoC exploit code generation by the Ollama model, SQL injection attempts, credential extraction from compromised systems, privilege escalation, and remote command execution. Each decision—which target to probe, which exploit to attempt, whether to escalate privileges—was delegated to the LLM rather than executed through traditional scripts Sysdig.

The attacker exploited a free, unauthenticated Ollama server funded by someone else—turning borrowed compute into a reasoning engine for autonomous offensive operations. No victims were publicly compromised in the documented lab-stage attack, and no threat actor has been named, arrested, or prosecuted.

This incident signals a structural shift in the agent threat landscape: AI models are no longer passive tools but active participants in multi-step attacks, making autonomous decisions about reconnaissance, exploitation, and post-compromise behavior.