Your inference may already be getting resold — and your logs can still look normal. If you run an inference API, gateway, or AI product and you’ve seen suspicious credential sharing, resale, or unexplained usage, DM me. I’m looking to talk to teams seeing this in production. There is a growing reseller market built around stolen API keys, shared subscriptions, proxy access, account farms, and piggybacked sessions. The scary part: much of it can look completely legitimate from the provider side. Valid credential. Valid account. Normal-looking requests. Meanwhile, the same access can be passed through brokers, resold across borders, or quietly used by someone the account owner has never heard of. Most LLM security products focus on what an agent is doing. The blind spot is who is actually behind the account. That’s what we’re building at @infertrail: behavioral detection for inference abuse, credential resale, and unauthorized access. We’re publishing honeypot data, reseller-market research across Russian- and Chinese-language communities, attack patterns, and what we learn building detection for this problem. Follow @infertrail for the research.

As if we didn’t have enough 0days already

Ah yes even more terrifying news lol

i just saw this. weird no?

PHP and SSL CA's being broken in the same week... It's like finding out all building foundations are fucked

Distillation is bad for us because reasons

we are living in a brave new world of infosec

apparently we have node2shell today as well????

summary of eMudhra situation

so we don't even have a true patch to the most consequential 0 day of 2026. we are so screwed

this is why trust is so important in software. if you can't trust a scanner then it degrades trust in all your other cyber products even if they are internal

did they time this to go down the same time that PHP and SSL cert apocalypse happened lol

With the recent disclosures of php2shell, litellm breach and the eMuhdra’s SSL compromise it’s becoming more and more clear how cybersecurity is going to become a big issue for software developers and can no longer be thought of as an afterthought. Attacks are becoming more and more frequent and what companies now need more than ever is to detect breaches as fast as possible and patch asap. At InferTrail we’ve been seeing this a lot with inference abuse at scale. We are committed to helping companies close these gaps wrt to inference theft and stop companies from losing money with fraud abuse and more. These operations aren’t fly by night they are serious operations that are not just in China or Russia but all around the world.

the boring prep that helps when the next critical vuln drops: know which services run what keep runtimes supported make sure your WAF can’t be bypassed keep internal tools off the public internet limit what a compromised worker can access practice patching every replica ‘we patched the host but missed the containers’ is an avoidable incident. Stay safe out their folks

Here we go again lol. They should literally just call GitHub Actions GitHub Degradations

I wonder if the NSA uses a lot of PHP

Gonna say it this is one of the least clandestine operations in history. KSA is basically admitting they funded the guy by offering to cover his bail

I've been seeing this a lot in my own security research at InferTrail. We are seeing increase in attacks to steal their inference. This is unfortunately not going to stop its going to get worse.

Turns out if you convince enough people you can just become CA without ever doing due diligence.