PoeLLM cryptomining malware infects 3,400+ servers, mostly exposed AI tools

Lumen's Black Lotus Labs reports malware called PoeLLM has compromised more than 3,400 servers. Most of the victims were exposed AI tooling such as LiteLLM and Ollama, and the malware is used for cryptomining.

Why it matters: Self-hosted LLM gateways and runtimes are often deployed with default or no authentication, making them an easy new attack surface as local AI adoption grows. It echoes the broader theme in recent coverage that AI infrastructure itself, not just models, needs hardening and containment.