Two stories landed within hours of each other yesterday, and together they paint an uncomfortable picture: the infrastructure holding up the AI boom has a security maturity problem, and attackers have already noticed.

First, the unpatched flaw. LMCache is open-source software used to accelerate large language model servers — it's essentially a performance layer that sits between your LLM workers and a shared cache, letting multiple inference processes share KV-cache results without re-computing them. It's widely deployed in setups running vLLM, the most popular open-source LLM serving framework. Researchers disclosed a critical vulnerability in LMCache's multiprocess mode this week: because the cache runs as a standalone server reachable over ZeroMQ, an unauthenticated attacker with network access can send a specially crafted message and achieve remote code execution on the cache server. No login required. No patch available. The fix is to ensure LMCache is not exposed to untrusted networks — a mitigation that requires you to know you're vulnerable in the first place.

That's the problem. A lot of organisations stood up LLM inference stacks fast, following tutorials that prioritised getting things running over hardening the network boundary. LMCache's own documentation doesn't prominently warn against internet-exposed deployments. So the combination of a critical flaw, no patch, and a large pool of likely-misconfigured targets is about as bad as it gets.

Then there's PoeLLM, which demonstrates what "large pool of misconfigured AI targets" looks like in practice. Researchers from Lumen's Black Lotus Labs tracked a campaign called Canto Incognito that has compromised more than 3,400 servers running exposed AI and LLM infrastructure. The malware — dubbed PoeLLM for its unusual trick of encoding its command-and-control server address inside a poem, making it harder to detect in network logs — installs cryptocurrency miners and recruits hosts into a botnet. The motive is financial, not espionage, but the technique is transferable: if you can reach an exposed LLM server to drop a miner, you can reach it to do far worse.

Why does this matter beyond crypto miners? LLM inference servers often have access to sensitive data — prompts, outputs, sometimes direct API keys to other services. A compromised inference server is a pivot point into whatever it touches. For enterprises that have bolted AI onto their existing internal tooling, that surface area can be significant.

Australian organisations deploying open-source LLM stacks — increasingly common in universities, research institutions, and enterprise AI pilots — should treat this as a prompt to audit network exposure of any LMCache or vLLM deployments. The ASD's Essential Eight doesn't yet have specific guidance on LLM infrastructure hardening, but the fundamentals apply: don't expose inference servers to the internet, segment them from production systems, and monitor for anomalous outbound traffic.

What to watch: Whether LMCache maintainers release a patch, and whether CISA issues an advisory. Given there's no fix yet, defenders are flying on network controls alone. The combination of a known unpatched RCE and an active botnet campaign targeting the same infrastructure class makes this one worth actioning today, not next sprint.