# PoeLLM malware turns exposed AI servers into mining resources

> Lumen researchers describe attacks on vulnerable AI infrastructure. The target is the server running the service, not the model's answers.

Source: https://fmcybersecurity.com/en/insights/ai-security/poellm-malware-targets-ai-servers/
Locale: English
Other locale: https://fmcybersecurity.com/insights/ai-security/poellm-skadevare-rammer-ki-servere/

## Metadata

- Date: 2026-10-13
- Author: christian-vik
- Topic: ai-security
- Format: news
- Scope: international

**In brief:** Lumen's Black Lotus Labs reports that PoeLLM malware has affected more than 3,400 servers. Compromised systems are used for cryptocurrency mining and to find further targets.

The [research into the Canto Incognito campaign](https://www.lumen.com/blog/en-us/canto-incognito-tracking-the-poellm-malware) describes vulnerable, internet-facing services, including LiteLLM and Ollama. Activity dates back to April 2026; the victim total includes other software too.

## What sits behind an AI application?

[Ollama](https://docs.ollama.com/) can run a language model on a computer. An application can send it a request and receive a response.

[LiteLLM](https://docs.litellm.ai/) has a different role: its gateway provides a common connection to different model providers, with controls for access and spending. A gateway is an intermediary that handles requests between an application and a service.

These are software services with their own deployment and access arrangements. The security of that software is a separate question from whether a model gives a reliable answer.

## How the infected servers stay connected

PoeLLM reads a GitHub-hosted poem to calculate its control-server address. Changing the poem redirects infected machines, according to Lumen.

Cryptocurrency mining uses computing capacity to earn digital currency. When that work runs without the owner's consent, the owner supplies the resources while someone else receives the benefit.

For a business operating AI services, this illustrates a tangible consequence of a server compromise: capacity bought for business applications can be put to another use. It is an infrastructure-security story, not evidence that an AI model independently chose to hack.

Our [Tensorlake article](/en/insights/ai-security/tensorlake-ai-sdk-installation-attack/) covers another part of this infrastructure: the software developers install to connect their applications to AI services.

---

For the full documentation index, see https://fmcybersecurity.com/llms.txt
For the complete corpus as a single document, see https://fmcybersecurity.com/llms-full.txt