Self-hosted AI security is no longer a side task you get to next quarter. This week, researchers revealed a malware campaign that quietly took over more than 3,400 servers running popular open-source AI tools. The attackers did not want chatbots. They wanted the GPUs.

The malware is called PoeLLM, and it hunts for exposed LiteLLM and Ollama setups, plus a few other common tools. I coordinate projects where our team spins up AI gateways and model servers for clients, so I read the full research. Here is what happened, in plain words, and what agencies in India and the USA should check today.

Hooded hacker with bitcoin glasses working on a laptop in front of streams of binary code — PoeLLM turns exposed AI servers into cryptocurrency miners. Image: BleepingComputer.

What Happened: PoeLLM Malware Hits Exposed AI Servers

On October 7, 2026, Lumen's Black Lotus Labs published its report on PoeLLM. BleepingComputer covered the PoeLLM campaign the same day, and its summary is a good quick read.

Here are the verified facts so far:

More than 3,400 servers hit. Peak activity reached about 800 infected systems active on a single day.
Active since at least April 2026. The first GitHub commit tied to the campaign was made on April 13.
Targets are mostly in the US and Western Europe. That matches where these AI tools are most widely deployed.
The goal is money. The malware carries the XMRig and Iron crypto miners and connects to Kryptex, a Russian mining service.
Victims become attackers. Each infected server scans the internet and launches exploits against new targets.

The researchers could not name the operator with confidence. They assess with moderate confidence that the person behind it is Italian, based on Italian comments in the code and an admin server hosted in Italy.

Which Tools Were Targeted

Most victims were running open-source software that teams often install in an afternoon and then forget. Black Lotus Labs named four main groups, plus one possible extra target.

Tool	What teams use it for	What the research found
LiteLLM	AI gateway that routes calls to many LLM APIs	Scanned on port 4000; exploit aimed at its MCP test endpoint
Ollama	Running open models on your own hardware	Many exposed instances among the victims
Gotenberg	API that converts documents to PDF	Scanned on port 3000; its own docs warn against exposing it online
Gitea	Self-hosted Git service	Named as a main victim group, alongside Gotenberg
Ivanti Sentry	Commercial mobile access gateway	Possible target, linked to CVE-2026-10520

Notice the pattern. None of these are exotic. If your agency builds AI features, there is a good chance at least one of them is running on a cloud VM somewhere right now.

The LiteLLM Flaw Behind Many Infections

The clearest entry point is a LiteLLM bug tracked as CVE-2026-42271. The NVD entry for CVE-2026-42271 explains it: two endpoints used to preview an MCP server before saving it would run any command sent to them.

Those endpoints are /mcp-rest/test/connection and /mcp-rest/test/tools/list. They needed only a valid proxy API key, with no role check. So even a low-level internal key could run commands on the host.

It gets worse. Researchers at Horizon3.ai showed the bug can be chained with CVE-2026-48710, a Starlette flaw nicknamed "BadHost." Together, they allow remote code execution with no login at all. Horizon3 rates the chain as CVSS 10.0, the highest score.

The key version numbers:

Affected: LiteLLM 1.74.2 through 1.83.6, and setups with Starlette 1.0.0 or older.
Fixed: LiteLLM 1.83.7, released May 8, 2026, and Starlette 1.0.1.

The fix has been out for five months. Yet PoeLLM still found thousands of servers to infect. That gap between "patch available" and "patch applied" is the real story here.

Black Lotus Labs diagram of the PoeLLM campaign showing infected LiteLLM, Ollama, Gotenberg and Gitea servers feeding a crypto mining pool — How the PoeLLM campaign works, from the attacker's admin server to infected AI servers. Image: Lumen Black Lotus Labs.

How the Poem Trick Works

This is the part that grabbed headlines. Most malware has a fixed address it calls home to, which defenders can block. PoeLLM does something stranger.

It reads a two-stanza poem called "On the Nature of Connection." The poem sits in a file named dash.css inside a GitHub repository that copies the Node.js website code. The malware has nothing to do with Node.js; the copy is just cover.

The malware pulls four specific words from the poem.
A built-in dictionary turns each word into a number.
The four numbers form the IP address of the attacker's command server.
When the attacker wants to move, they edit those four words. Every infected server then finds the new address on its own.

The poem has been changed 11 times so far. Black Lotus Labs found 12 command server addresses in total, with three still active when the report went out. Several of them were compromised routers, not rented servers.

For defenders, the lesson is simple. Blocking one bad IP will not stop this kind of malware. You have to stop the first break-in.

Why Self-Hosted AI Security Is Now a Real Risk

Black Lotus Labs makes a point every agency owner should hear. AI servers are attractive targets for three reasons:

They are often badly set up. Teams install them fast for a demo or a pilot and open ports to test from anywhere.
They run on powerful GPUs. That hardware is perfect for mining, and you pay the cloud bill.
They hold valuable data. Horizon3 notes that a hacked LiteLLM proxy can expose model provider keys and secrets, and give a path into connected systems.

Mining is the visible harm here. The quieter risk is stolen API keys, client data and a foothold inside your network. A crypto miner is annoying. A leaked OpenAI or Anthropic key tied to a client account is a much harder conversation.

A Familiar Scenario

Here is a pattern that is common on busy delivery teams. A developer sets up a LiteLLM proxy on a GPU VM for a client proof of concept. They open the port so the client can test from their office. The demo goes well, the project moves to another stack, and nobody closes that port.

Months later, the VM is still running, still unpatched and still public. That is exactly the kind of server PoeLLM was built to find.

Timeline chart of the PoeLLM campaign and the LiteLLM CVE-2026-42271 fix from April to October 2026 — Key dates in the PoeLLM campaign and the LiteLLM fix. Sources: Lumen Black Lotus Labs, Horizon3.ai, BleepingComputer. Graphic: Debugged Pro.

A Self-Hosted AI Security Checklist for This Week

You do not need a new security tool to act on this. Most of these steps take an hour or two per server.

List every AI tool you run. Include LiteLLM, Ollama, Gotenberg, Gitea and anything else on client or internal servers. Note who owns each one.
Check what is public. Scan your own IP ranges, or use your cloud console, to find services answering on ports like 3000, 4000 and 11434.
Patch LiteLLM now. Move to 1.83.7 or later and confirm Starlette is 1.0.1 or later. Check your Docker images too, not just pip installs.
Take services off the open internet. Put them behind a VPN, a private network or an IP allowlist. Ollama listens only on localhost by default, so check whether someone changed that.
Rotate secrets. If a LiteLLM proxy was ever exposed on a vulnerable version, rotate every model provider key and secret it stored.
Read your logs. Look for calls to the MCP test endpoints, strange Host header values and processes your team did not start.
Watch the bills. A sudden jump in GPU or CPU use, or outbound traffic to mining pools, is often the first sign.

Black Lotus Labs also publishes its indicators of compromise on GitHub. If you run a firewall or SIEM, load that list and search back through your logs. The full Black Lotus Labs PoeLLM report has the complete list and more technical detail.

Make AI Tools Part of Normal Patch Work

The bigger fix is a habit, not a single patch. Black Lotus Labs says AI tools should sit inside your normal attack surface checks and update cycles. Right now, many teams treat them as experiments that live outside those rules.

We made this point recently in our guide to patch management for agencies. The same rules apply here: know what you run, track versions and patch on a schedule. The recent Atlassian vulnerability that attackers exploited within days showed how fast a public fix turns into a public exploit.

A few simple rules help:

No public AI endpoints by default. Exposure should need a written reason and an end date.
Every demo server gets an owner and an expiry date. When the date passes, it gets shut down or reviewed.
AI tools go into the same patch tracker as your web servers, databases and CMS plugins.
Client handover includes security notes. If you deploy LiteLLM for a client, tell them how to update it and who to call.

What This Means for Agencies in India and the USA

Most PoeLLM victims were in the US and Western Europe. Indian agencies should not relax because of that. Many of us host client workloads in US cloud regions, so our servers sit right in the target zone.

For US businesses that hire offshore or outsourced teams, ask a direct question this week: "Which AI services are you running for us, and are any of them public?" A good partner will have the answer ready.

Key Takeaways

PoeLLM has hit more than 3,400 servers running exposed AI and dev tools such as LiteLLM, Ollama, Gotenberg and Gitea.
The main LiteLLM bug is CVE-2026-42271. Chained with a Starlette flaw, it allows remote code execution with no login.
The fix exists: LiteLLM 1.83.7 or later and Starlette 1.0.1 or later.
Self-hosted AI security starts with exposure. Keep AI tools off the open internet and rotate any keys on exposed servers.
Treat AI tools like any other server in your patch and monitoring routine.

How Debugged Pro Can Help

We build and run AI gateways, model servers and automation for businesses in India and the USA. If you are not sure what your AI stack exposes, our software development consulting team can review your setup and help you close the gaps.

About the Author

Nitin Kumar is the Lead Project Coordinator at Debugged Pro. He manages AI, web and mobile projects for clients in India and the USA. He spends much of his week turning security and tech news into practical plans for delivery teams.