Arielle

building @infertrail and memes. someone's using your llm keys and it's not you. i catch that.

[Arielle @polydaic]

Your inference may already be getting resold — and your logs can still look normal.

If you run an inference API, gateway, or AI product and you’ve seen suspicious credential sharing, resale, or unexplained usage, DM me. I’m looking to talk to teams seeing this in production.

There is a growing reseller market built around stolen API keys, shared subscriptions, proxy access, account farms, and piggybacked sessions.

The scary part: much of it can look completely legitimate from the provider side.

Valid credential. Valid account. Normal-looking requests.

Meanwhile, the same access can be passed through brokers, resold across borders, or quietly used by someone the account owner has never heard of.

Most LLM security products focus on what an agent is doing.

The blind spot is who is actually behind the account.

That’s what we’re building at @infertrail: behavioral detection for inference abuse, credential resale, and unauthorized access.

We’re publishing honeypot data, reseller-market research across Russian- and Chinese-language communities, attack patterns, and what we learn building detection for this problem.

Follow @infertrail for the research.

[Arielle @polydaic]

@IndraVahan My favorite is them mentioning the tourist tax like they are visiting a restaurant in Japan

[Arielle @polydaic]

@zjasper They are basically the new rental properties

[Arielle @polydaic]

@mbrg0 lol it’s almost a ritual at defcon.

[Arielle @polydaic]

@DanielLockyer Because it’s poorly maintained. Try jellyfin less bloat and much smoother experience without the sales tactics

[Arielle @polydaic]

@joshuacirjak How many of those do you need to run Deepseek 1017

[Arielle @polydaic]

Are we all supposed to do this now lol

[Dimitri @thedimitri]

messaging my wife a link containing proof of her husband cheating on her from an anonymous instagram account and then when she clicks on it texting her to let her know she failed the family phishing test and she has to retake my cybersecurity course

[Arielle @polydaic]

@FoxyhitsW Probably even more. Not everyone is going to leave a review

[Arielle @polydaic]

@localghost I thought this was well known? This is the reason TVs became so cheap

[Arielle @polydaic]

@ZackKorman The swarms are the machine guns in this analogy I guess and the defenders are those trying to storm the trench or is it the other way around lol

[Arielle @polydaic]

@ds1dbx Are you sure though

[Arielle @polydaic]

@aeejazkhan lol why is he even asking for advice? It’s obvious to find a different company or team

[Arielle @polydaic]

@MaxForAI It’s also the model they like to use the most from their resellers lol

[Arielle @polydaic]

@arpitatscale How is this a thing lol. I though GTM go to market to go to morgue

[Arielle @polydaic]

@yagiznizipli You found a better way to do minification?

[Arielle @polydaic]

@TrustlessState I don’t think anything is going to happen before the midterms. Republicans are already not polling well it’d be suicidal for them to give the public another reason

[Arielle @polydaic]

@IceSolst Paid + referral only tier

[Arielle @polydaic]

@creatine_cycle You know it’s not a good strat when corgi is pivoting to it lol

[Arielle @polydaic]

@RhysSullivan Sure but it also means that your api keys and passwords could be potentially transmitted over prompts which in the case of a data breach of a gateway or model provider would essentially allow attackers complete access

[Healthy Living @healthynotes_]

@polydaic 1/8 **CRITICAL SECURITY ADVISORY: CVE-1985-PING2SHELL**

**Severity:** Critical (CVSS 10.0)

**Affected Systems:** UNIX, Windows (all iterations dating back to 1985), and virtually every networked device since the dawn of TCP/IP.

Our incident response and threat intelligence