A security researcher showed that a rogue LLM endpoint can hijack an AI-driven coding agent and steal local files. In a proof-of-concept, the coding assistant uploaded a 224 KB session—directory listings, tool manifests, and private file contents—to a counterfeit “DeepSeek-compatible” API advertised among free AI back-ends.

How the hijack works

Scanners first discovered an exposed LLM honeypot. Attackers re-branded the honeypot as a legitimate DeepSeek endpoint and listed it with other free services. When a developer’s coding agent picks this endpoint for “free” access, the rogue model takes control of the agent’s plane. It sends tool-call instructions that the agent executes without checking their source. The agent then streams its internal session data—filesystem snapshots, tool configurations, and any opened files—directly to the attacker’s server.

Why this is a supply-chain threat

The attack bypasses any trusted cloud provider. Instead, it injects a fake reasoning backend into the developer’s toolchain. Users chasing cost-free API access unwittingly become the weakest link. Because the malicious endpoint can issue arbitrary tool calls, it can exfiltrate any data the agent can reach, turning the developer’s machine into a data-leak conduit.

Who is at risk

Anyone who relies on external LLM endpoints for AI coding assistants—especially those that automatically execute tool calls—is exposed. Small teams and hobbyists are most vulnerable; they adopt free services without rigorous vetting. Enterprises that have woven such agents into CI/CD pipelines could leak internal codebases and configuration files, jeopardizing compliance.

Mitigation steps

  • Verify back-ends: Connect coding agents only to officially documented and authenticated LLM endpoints.
  • Enforce runtime checks: Add a verification layer that inspects tool-call payloads before they reach the local execution environment.
  • Restrict file access: Run agents in sandboxed containers with the minimum filesystem permissions needed.
  • Audit logs: Continuously monitor outbound requests from agents for unexpected destinations or data volumes.

Counterpoint

Free API offerings lower the barrier to AI-assisted development, and many users accept the trade-off between cost and security. Yet the demonstrated exfiltration of private files shows the risk can quickly outweigh the savings, especially when proprietary code or credentials are at stake.

Takeaway: Free LLM endpoints hide a cost—potential data theft. Vet every backend and enforce strict runtime safeguards before letting AI coding agents run locally.

Read the full technical report for details: https://gridthegrey.com/posts/rogue-llm-endpoint-hijacks-coding-agent-sessions-via-free-api/