LLM-powered tooling is becoming a force multiplier for attackers, from reconnaissance automation to post-exploitation enumeration. Using their own API keys creates attribution and cost, so they look for alternatives.

Thousands of inference endpoints sit exposed on the internet: misconfigured Ollama instances, open vLLM deployments, leaked API keys in directory listings, and expired OAuth tokens from AI coding assistants that can be silently refreshed. Attackers can discover these resources and use them as free compute for their operations, without spending a dollar or registering an account.

Attendees will learn how to:

•⁠ ⁠Discover exposed inference endpoints and leaked API keys using Infreerence
•⁠ ⁠Validate that discovered resources provide usable inference access
•⁠ ⁠Operate Echidna, powered entirely by discovered inference
•⁠ ⁠Chain LLM skill agents together to execute a guided campaign against a target network

Current LLMs are effective force multipliers when directed, and significantly more so when the compute bill goes to someone else. This is resource hijacking applied to the AI era: living off someone else's inference. Understanding this threat is essential for any organization deploying or exposing AI infrastructure.

Two tools will be released as open source during the session:

•⁠ ⁠Infreerence: A multi-phase scanner and dashboard that discovers exposed inference endpoints and leaked API keys through Shodan and Censys, validates them against live provider APIs, and catalogs usable inference resources across 10+ providers.
•⁠ ⁠Echidna: A Mythic C2 agent type that consumes discovered inference endpoints and turns them into operator-directed skill agents for reconnaissance, exploitation planning, post-exploitation, and lateral movement.

Infreerence

Purpose: Discover and catalog exposed LLM inference endpoints and leaked API keys across the internet.

How it works:

The tool runs five sequential scan phases, each building on the results of the previous:

1. Search: Queries Shodan and Censys with 20+ purpose-built search patterns targeting known inference services (Ollama, vLLM, LocalAI, LiteLLM, Open WebUI, AnythingLLM, and others). Deduplicates results by host and port.
2. Probe: Hits discovered hosts with unauthenticated metadata requests to detect and classify the inference service. If metadata suggests open access, sends a minimal canary prompt to confirm inference works. Classifies risk as critical (unauthenticated inference confirmed), high (models exposed), medium (requires auth),or info (service detected only). Measures tokens-per-second to fingerprint hardware (GPU vs CPU).
3. Sensitive Files: Crawls confirmed inference hosts for known config paths: .env files, .codex/auth.json, .claude/credentials.json, .continue/config.json, .copilot/hosts.json, and similar. Includes honeypot detection to filter out wildcard responders.
4. Directory Listings: Searches for open directory listings associated with AI tooling. Recursively crawls them and extracts API keys using 30+ regex patterns with entropy checks and false-positive filtering.
5. Key Validation: Validates every extracted key with a live inference call against the provider's API. Supports OpenAI, Anthropic, Google (API key and GCP service account), AWS Bedrock (SigV4), Azure OpenAI, Groq, Mistral, and others. For expired OAuth tokens from coding assistants (Codex CLI, Claude CLI, Copilot, Continue, Codeium, Cody), attempts a silent token refresh before validation.

Interface: FastAPI web dashboard with scan management, real-time progress tracking, findings browser, chat interface to interact with discovered endpoints, and JSON export.

Output: Categorized inventory of confirmed inference endpoints and validated API keys, with provider, risk level, discovered models, and validation status.

------
Echidna

Purpose: A Mythic C2 agent type that turns LLM inference endpoints into operator-directed skill agents for red team operations.

How it works:

Echidna is a virtual agent, meaning no payload binary is generated. When built, it creates an instant callback in Mythic configured with a provider (Anthropic, OpenAI, or Google) and an API key or endpoint URL. From there, the operator directs the agent through Mythic's UI.

Core commands:

- chat: Direct conversation with the LLM through the callback. Useful for ad-hoc queries, analysis, or planning.
- skill: Execute one of the isolated skill agents, each with its own system prompt, tool policy (strict binary allowlist), and output schema.
- campaign: Chain multiple skills together with approval gates before dangerous actions. Can run in interactive mode (pause between every skill) or auto mode (pause
only before high-risk skills like privilege escalation or persistence).
- report: Generate a findings report from all skill outputs collected during the session.
- model: Switch the backing LLM model mid-operation.

The current skill agents:

Reconnaissance: passive-recon, active-recon, attack-surface-analyzer
Planning: exploitation-planner
Exploitation: exploitation-executor, credential-validation
Post-exploitation: post-exploitation, privilege-escalation, lateral-movement
Persistence and evasion: persistence, edr-bypass, data-exfil
Cloud: cloud-enumeration

Delegation to real implants:

Skills that require execution on a target (post-exploitation, privilege escalation, lateral movement, etc.) communicate through a delegation bridge. The bridge links the LLM skill agent to an existing implant callback (Apollo, Merlin, or similar) in Mythic, allowing the skill to issue commands on the target and receive output synchronously. The operator sees all delegated commands in Mythic's task log.