Coding Agents Can Turn Model Endpoints Into Control Planes
SANS ISC said an internet-exposed honeypot on 2026-08-30 received 210 requests in 91 seconds that carried a real opencode coding-agent session, including history, filesystem output, working paths, and the agent’s local tool manifest. The backend was relabeled with sought-after model names and appeared to sit inside a “free” LLM service.
The point is not just that the endpoint answered prompts. A tool-enabled agent brings file-read, file-write, and shell tools with it, and it trusts the server to help choose the next step, so a hostile or misdirected inference server can expose local context and steer tool calls on the client machine. In that setup, the model backend is part of the control plane, not just a text source.
If your agents can read files or invoke tools and they talk to third-party or self-hosted inference endpoints, the trust boundary reaches past the chat session to the agent host itself. The report shows the exposure lives where the backend can influence execution, even when no tool call was actually triggered in the honeypot session.