One night, four keys
The attackers have been asking for the config files of LiteLLM and similar tools: these are the proxies people put in front of their AI models, often with the cloud keys sitting right there in the config. With this release, The MIRE has one of those now, and the AWS key in it is a canary.
Right now, the keys are being tried from somewhere between 53 and 93 different addresses, each address making one call. That’s a residential proxy pool doing its job, avoiding volumetric triggering where a single IP is overused. The calls tell the story: “who am I?”, then how many emails the account may send, whether it can send text messages, and which AI models it may run. Spam and free AI, on someone else’s bill. The fastest key was in use 14 seconds after it was taken.
Only “who am I?” ever worked. Of course!!
What’s new in 2026.11
Ten days of work went into this one, so here are the highlights. The full list is in the version history.
More bait, where it’s actually wanted. I went through the logs for everything that scanners kept asking for and The MIRE kept answering with a shrug. Terraform state, Kubernetes configs, shell history, build scripts, front-end config files, the .bak copy someone forgot to delete, and the AI-proxy configs from above. Each now gets a file in its real format. The fresh canaries go to the files whose keys really get used; the rest share.
Every site tells one story. Each site’s decoys now belong to one made-up company, and the files agree with each other. The SSH key matches its public half, the cloud files match the canary, the Git remote has a login. Anyone who checks one file against another finds what they hoped to find.
A login for every app. One sweep went through ten sites asking for the sign-in, sign-up and password-reset pages of a SaaS dashboard that was never there. Now they are willing, answering. Frustratingly, no login ever works.
Attacks hiding in plain sight. A static page ignores its query string, so anything tacked on to a real page got a polite 200 and disappeared. About 9’400 of those since July, nearly three in four asking for a WordPress that doesn’t live here any more. They now land in The MIRE, where they belong.
Repeat offenders, noted. An address whose stolen key was used is flagged whenever it comes back. For now I only watch but this is one for the backlog.
Fewer tells. Some scanners check for honeypots by asking for pages that can’t exist. Those now get a plain “not found”, as they would anywhere else.
What comes next
The field report with the full canary story is on its way: all 30 keys, who took them, how fast they used them and what they were after. Until then, the statistics page has the numbers, updated hourly.
2026.12 will be on time. Probably.
Thanks for reading.
It seems the world (or at least the attackers and scanners on the Internet) has been searching for AI-proxy config files. The MIRE has been handing files and keys out since version 2026.11 was released.
Release 2026.11 was meant for the start of November. But with traps biting like that, I couldn’t sit on it for another ten days. So it’s out early, and Freddie gets the title.
All times are Swiss local time.