Advanced threat intelligence
Kinryū Labs
We're a research group that finds vulnerabilities in space systems, runs honeypot networks to watch attackers in the wild, and produces cyber threat intelligence. We report what we find to the organisations affected, and publish what we can - once it's ready and cleared for release.
Doing it for the love of the game.
Latest reports
View all →-
Threat teardown
Open Inference APIs Validated With Per-Model Canary Prompts
This is a validation run against internet-exposed self-hosted LLM inference APIs on TCP/11434: a Go HTTP client lists the models an endpoint advertises, then sends one throwaway echo prompt per model to confirm each one really generates text.
llm-abuse · llmjacking · ai-infrastructure · inference-endpoint · self-hosted-llm · scanning
-
Threat teardown
DeepSeek Harness Abuse: An Autonomous Agent Exposes Its Operator's Host
This is an operator stealing inference from an internet-exposed OpenAI-compatible model endpoint by pointing the open-source DeepSeek Harness coding agent at it, whose auto-approving tool loop then ran the endpoint's tool calls on the operator's own Windows workstation and posted the output back.
llm-abuse · agent-harness · deepseek-harness · api-key-abuse · mcp · fofa
-
Threat teardown
DeepSeek Harness Against a Stolen LLM Gateway: Tool Calls Run on the Caller
This is an agentic LLM client, DeepSeek Harness, DeepSeek's developer-preview agent framework, pointed at a honeypot LLM gateway by the two addresses that had replayed a virtual key minted on that gateway the day before.
llm-abuse · litellm · llm-gateway · agent-harness · deepseek · credential-abuse
kinryu@lab