Pillar Security has identified two primary campaigns: “Operation Bizarre Bazaar,” focused on exploiting unprotected LLMs, and a second campaign targeting Model Context Protocol (MCP) endpoints. The accessibility of these targets is a key factor in the campaigns’ success. Attackers are leveraging readily available tools like the Shodan and Censys IP search engines to identify vulnerable systems.

Organizations at risk include those running self-hosted LLM infrastructure – such as Ollama, vLLM, and local AI implementations – as well as those deploying MCP servers for AI integrations. Specific vulnerabilities include:

• Exposed endpoints utilizing default ports for common LLM inference services.
• Unauthenticated API access lacking proper access controls.
• Development and staging environments with publicly accessible IP addresses.
• MCP servers connecting LLMs to critical file systems, databases, and internal APIs.

Common misconfigurations that attackers are exploiting include Ollama instances running on port 11434 without authentication, OpenAI-compatible APIs on port 8000 exposed to the internet, MCP servers accessible without access controls, and production chatbot endpoints lacking authentication or rate limiting.

George Gerchow, Chief Security Officer at Bedrock Data, highlights the evolving nature of the threat. “Operation Bizarre Bazaar signifies a shift in attacker behavior. They’re no longer simply experimenting with LLM abuse; they’re treating exposed AI infrastructure as a fully monetizable attack surface. The increasing reliance on the Model Context Protocol (MCP) adds another layer of complexity, as these integration points can become pathways to internal systems if not properly secured.”

Defenders must adopt a security posture comparable to that applied to APIs and databases, prioritizing authentication, telemetry, and proactive threat modeling throughout the development lifecycle. Securing MCP interfaces, not just model access, is now a critical imperative.

The Pillar Security report details three core components of the Bizarre Bazaar campaign:

• The Scanner: A distributed botnet systematically probes the internet for exposed AI endpoints, cataloging vulnerable Ollama instances, unauthenticated vLLM servers, and accessible MCP endpoints. Exploitation attempts often begin within hours of discovery.
• The Validator: Once targets are identified, infrastructure linked to a criminal marketplace validates the endpoints through API testing, assessing model capabilities and response quality.
• The Marketplace: Discounted access to over 30 LLM providers is being sold on a site called The Unified LLM API Gateway, hosted on resilient infrastructure in the Netherlands and promoted on Discord and Telegram.

Early buyers of this access appear to be individuals building their own AI infrastructure to reduce costs, as well as those involved in online gaming. However, the potential for more malicious actors to leverage this access is significant.

The threat extends beyond fully developed applications. Even developers prototyping AI applications, who may inadvertently leave servers unsecured, are vulnerable to credential theft and exploitation.

Joseph Steinberg, a US-based AI and cybersecurity expert, emphasizes that this report underscores the need for new security solutions tailored to the unique risks posed by artificial intelligence. Steinberg argues that traditional IT controls are often insufficient to address these emerging threats.

Do organizations have the in-house expertise to securely deploy and protect AI projects, or should they consider outsourcing to specialized providers? This is a critical question CSOs must address.

Frequently Asked Questions About AI Infrastructure Security

• What is LLMjacking and why is it a concern?
  LLMjacking refers to the unauthorized use of large language models (LLMs) by malicious actors, typically to steal compute resources or resell access. It’s a concern because it can lead to financial losses, data breaches, and reputational damage.
• How can I determine if my LLM endpoints are vulnerable to attack?
  You can use vulnerability scanners and penetration testing to identify exposed endpoints and misconfigurations. Regularly auditing your infrastructure and implementing strong authentication measures are also crucial.
• What is the Model Context Protocol (MCP) and why is it a target for attackers?
  The Model Context Protocol (MCP) is an emerging standard for securely connecting LLMs to data sources and tools. Attackers target MCP servers because they can provide access to sensitive internal systems.
• What are some common misconfigurations that attackers exploit in AI infrastructure?
  Common misconfigurations include running Ollama without authentication, exposing OpenAI-compatible APIs to the internet, and leaving MCP servers accessible without access controls.
• Is outsourcing AI development a viable security strategy?
  Outsourcing AI development to a provider with specialized security expertise can be a viable strategy, particularly if your organization lacks the necessary in-house skills.
• How can rate limiting help protect against AI infrastructure attacks?
  Rate limiting can prevent attackers from overwhelming your systems with a large number of requests, mitigating the impact of burst exploitation attempts.
• What role does employee training play in securing AI infrastructure?
  Employee training is crucial for raising awareness about AI security risks and promoting safe usage practices. Educated employees are less likely to fall victim to phishing attacks or inadvertently expose sensitive data.