PoeLLM malware turns exposed AI servers into mining resources
Lumen researchers describe attacks on vulnerable AI infrastructure. The target is the server running the service, not the model's answers.
In brief: Lumen’s Black Lotus Labs reports that PoeLLM malware has affected more than 3,400 servers. Compromised systems are used for cryptocurrency mining and to find further targets.
The research into the Canto Incognito campaign describes vulnerable, internet-facing services, including LiteLLM and Ollama. Activity dates back to April 2026; the victim total includes other software too.
What sits behind an AI application?
Ollama can run a language model on a computer. An application can send it a request and receive a response.
LiteLLM has a different role: its gateway provides a common connection to different model providers, with controls for access and spending. A gateway is an intermediary that handles requests between an application and a service.
These are software services with their own deployment and access arrangements. The security of that software is a separate question from whether a model gives a reliable answer.
How the infected servers stay connected
PoeLLM reads a GitHub-hosted poem to calculate its control-server address. Changing the poem redirects infected machines, according to Lumen.
Cryptocurrency mining uses computing capacity to earn digital currency. When that work runs without the owner’s consent, the owner supplies the resources while someone else receives the benefit.
For a business operating AI services, this illustrates a tangible consequence of a server compromise: capacity bought for business applications can be put to another use. It is an infrastructure-security story, not evidence that an AI model independently chose to hack.
Our Tensorlake article covers another part of this infrastructure: the software developers install to connect their applications to AI services.
