CISO Intelligence: Your LLM Stack Is Production Infrastructure Now
The most quietly important story is a vulnerability with no patch. LMCache, the open-source cache layer that speeds up large language model servers like vLLM, has a critical flaw in its multiprocess mode. An unauthenticated attacker can reach the cache server over the network and run code on it. There is no fixed version.
Read that again and set aside the CVE mechanics. The component that makes your inference serving fast, the thing sitting between your model and your users, is a network service with a remote code execution hole and nothing to upgrade to. If you deployed self-hosted LLM infrastructure in the last eighteen months because the board asked for an AI story, this is the bill arriving.
The AI server estate is now a target, and it is undefended
The PoeLLM campaign makes the same point with 3,400 servers. Exposed AI and LLM infrastructure is being swept up, turned into cryptocurrency miners, and repurposed as scanners and exploit launchpads for the next victim. The researchers behind it are tracking it as Canto Incognito, and the economics are mundane. AI servers are powerful, frequently internet-exposed, and often stood up by teams who are not security engineers.
That last part is the whole risk. A data scientist who needs a GPU cluster by Friday is not thinking about the attack surface. They are thinking about throughput. The infrastructure they build is real production infrastructure, but it was never through a security review, because it did not look like production infrastructure to anyone who does reviews. It looked like a research project.
If you cannot inventory the AI and LLM services running in your organisation, including the ones in a lab, on a departmental card, or in a cloud account nobody told you about, you do not have control of your attack surface. You have control of the part somebody remembered to tell you about.
Anthropic formalises who gets the sharp tools
Anthropic has folded Project Glasswing into a tiered Cyber Verification Program, giving vetted defenders access to more capable models, Opus, Sonnet and Mythos among them, with fewer automated blocks on offensive security work.
I wrote about the governance shape of this in early October, and it has not changed. Matching capability to trust is the least bad option. The question that remains is who controls the list of the trusted. Verification run by the vendor is a gatekeeping decision made in a commercial context, and every organisation outside it is dependent on somebody else's judgement about their legitimacy. Ask your supplier how the appeal works and who owns the outcome.
The practical move is still to pursue verification if your team does malware analysis or vulnerability research. The reduction in false refusals saves real hours. Just read what you are agreeing to about the data you route through the model, because that is the part nobody reads.
The supply chain keeps eating npm packages
Tensorlake, a TypeScript SDK for AI sandboxes and cloud services, had a version compromised as part of the ChainDrop and Shai-Hulud campaign. The malicious release harvested credentials, exfiltrated secrets, established persistence and fetched remote code.
This is not an AI story so much as a reminder that the AI tooling ecosystem is young, fast-moving and lightly governed. The packages your developers pull to build agent workflows and sandboxed execution are the same npm supply chain that has been attacked relentlessly for years. The novelty is the payload. Credential harvesting from a machine that holds cloud keys and model API tokens is a very good day for an attacker. Pin your dependencies, watch what your build machines can reach, and treat the AI SDK ecosystem with the same suspicion you apply to any other young, popular package.
What this means for you
1. Inventory your LLM and AI infrastructure, including the shadow deployments. If it serves inference or holds a model, it is production infrastructure and it needs a security owner.
2. Treat the AI server estate as internet-exposed by default and close what does not need to be reachable. Cache servers and inference endpoints should not be answering from the open internet.
3. For LMCache specifically, if you run it in multiprocess mode, isolate the cache server on the network and monitor it until a fix lands. There is no patch yet, so segmentation is the control you have.
4. Extend your supply chain controls to the AI SDK ecosystem. The packages are new, the attack patterns are not.
The common thread is that AI infrastructure has quietly become critical infrastructure without anyone granting it that status. It carries your data, it sits on your network, and in the last eighteen months it was mostly deployed outside the process that would have caught all of this. That process exists for a reason, and the reason is the news of the past fortnight.
,-
Sources: 21 publications checked, 10 AI-relevant stories analysed (24-hour window).