hrbrmstr 🇺🇦 🇬🇱 🇨🇦 🏳️‍🌈 on Mythryl: “The infrastructure ties back to established CVE exploitation…”

New research: Threat actors are actively mapping LLM infrastructure. Our Ollama honeypots captured 91K+ attack sessions. One campaign systematically probed 73+ model endpoints—GPT-4o, Claude, Llama, Gemini, and more—across 80K sessions in 11 days. www.greynoise.io/blo... 1/2

greynoise.ioThreat Actors Actively Targeting LLMsOur Ollama honeypot infrastructure captured 91,403 attack sessions between October 2025 and January 2026. Buried in that data: two distinct campaigns that reveal how threat actors are systematically mapping the expanding surface area of AI deployments.

Post