Adversarial Poetry Used in Malware Campaign to Bypass AI Safety Guardrails and Compromise Over 3,000 Servers

Researchers tracking the PoeLLM malware discovered the first confirmed real-world attack employing adversarial poetry—a technique that encodes harmful prompts as poems to trick large language models into ignoring safety restrictions. Since April, the malware has infected more than 3,000 servers primarily in the United States and Western Europe by targeting vulnerable internet-facing instances of open-source AI tools including LiteLLM and Ollama, which the attacker then used for cryptocurrency mining and botnet expansion. The use of poetry as a delivery mechanism allowed the malicious payload to evade detection because it appeared as harmless content on code repositories with no obvious malicious indicators.

The PoeLLM campaign represents a novel approach to malware delivery by disguising malicious instructions within creative content. The attacker leveraged GitHub repositories as distribution channels, exploiting the fact that poetry posted online appears innocuous and lacks the obvious red flags—executable files, suspicious links, or encoded data—that typically trigger security alerts. This method proved effective at evading both automated detection systems and human analysts unfamiliar with the specific adversarial technique being employed.

Once deployed, the malware transforms compromised servers into dual-purpose assets: systems running AI workloads have their computational resources redirected toward cryptocurrency mining operations, while simultaneously being converted into reconnaissance tools that scan networks for additional vulnerable targets. This dual functionality allows the campaign to sustain itself through profits while simultaneously expanding its reach across enterprise infrastructure.