Skip to content
Threat Feed
Subscribe

Product

KoboldCPP

3 briefs RSS
medium advisory

Detection of Local LLM Model File Creation on Endpoints

This brief describes how the creation of Large Language Model (LLM) files, including formats like .gguf, .safetensors, .ggml, and Modelfiles, by local AI inference frameworks such as Ollama, llama.cpp, GPT4All, and LM Studio can be detected on Windows endpoints, indicating potential shadow AI deployments, unauthorized model downloads, or rogue LLM infrastructure which poses data exfiltration risks and policy violations.

Ollama +9 shadow-it llm data-exfiltration policy-violation endpoint shadow-ai local-llm intellectual-property-theft +2
2r 5t
medium threat

Detection of Generative AI Processes Connecting to Unusual Domains

Adversaries may compromise macOS-based Generative AI (GenAI) tools through prompt injection, malicious Model Context Protocol (MCP) servers, or poisoned plugins to establish Command and Control (C2) channels or exfiltrate sensitive data by causing them to connect to unusual domains.

exploited Claude +8 command-and-control genai macos data-exfiltration
1r 1t
medium advisory

GenAI Process Connection to Unusual Domain on macOS

This rule detects GenAI tools on macOS connecting to unusual domains, potentially indicating command and control activity, data exfiltration, or malicious payload retrieval following compromise via prompt injection, malicious MCP servers, or poisoned plugins.

Copilot +22 genai command and control macos network connection
2r 1t