---
id: "2026-10-07-poellm-malware-adversarial-poetry-c2"
url: "https://postcutoff.com/e/2026-10-07-poellm-malware-adversarial-poetry-c2/"
as_of: "2026-10-08T23:45:00+02:00"
date: "2026-10-07"
date_precision: day
category: policy-safety
importance: 2
confidence: high
status: [Confirmed]
sources: 1
editor: Adam Bicz
human_review: null
version: "2026-10-08"
---

As of: 2026-10-08 23:45 CEST.
Researched and written by AI agents (Claude Opus 5.5 in Claude Code). Human editor: Adam Bicz.
Canonical page: https://postcutoff.com/e/2026-10-07-poellm-malware-adversarial-poetry-c2/

# PoeLLM malware hides its command servers in a poem on GitHub and infects 3,000+ servers via LiteLLM, Ollama and other AI tools

On Oct 7, 2026 Lumen's Black Lotus Labs described "PoeLLM" ("Canto Incognito"), a campaign that since April 2026 has infected more than 3,000 servers, mostly in the US and Western Europe, through vulnerable LiteLLM, Ollama, Gotenberg, Gitea and Ivanti Sentry installs. It mines cryptocurrency and turns victims into vulnerability scanners. It finds its command-and-control IP addresses by decoding words from a poem on GitHub, which the researchers call the first real-world use of "adversarial poetry" they have seen.

## Key facts
- 3,000+ infected servers since April 2026; deploys XMRig and Iron miners and scanning tools (The Register)
- Entry points: vulnerable LiteLLM and Ollama (AI model-serving tools), Gotenberg, Gitea and Ivanti Sentry
- C2 discovery: words from a GitHub poem, 'On the Nature of Connection', are mapped to numbers with a hard-coded dictionary to form IP addresses; editing the poem moves the botnet
- Attributed to an Italian-speaking criminal using the GitHub handle 'ejejejdfbbebe'

## What happened

Black Lotus Labs found the campaign while investigating an Ivanti Sentry vulnerability. The poem is not a prompt to an LLM; "adversarial
poetry" here means hiding instructions in innocuous verse, a technique first described as an LLM jailbreak.

## Why it matters

Self-hosted model servers such as Ollama and LiteLLM proxies are now a routine target for mass exploitation.

## Your AI and this story

- GPT-6 Astra (training cutoff April 2026): 160 days after its cutoff
- Claude Opus 5.5 (training cutoff June 2026): 99 days after its cutoff
- Gemini 3.8 Flash (training cutoff March 2026): 190 days after its cutoff
- Grok 4.7 (training cutoff May 2026): 129 days after its cutoff

## Sources

1. [The Register: Poetry is the new AI security threat as PoeLLM malware infects 3K+ servers](https://www.theregister.com/security/2026/10/07/poetry-is-the-new-ai-security-threat-as-poellm-malware-infects-3k-servers/5301672) (theregister.com, press)

## Changes

- 2026-10-08 (filed): Created