CVE-2023-1389 is a vulnerability tracked across 1 threat cluster and 2 intelligence report mentions on ThreatCluster. First observed January 8, 2026; most recent activity January 9, 2026.
Threat actors have been targeting misconfigured proxy servers to gain unauthorized access to commercial large language model (LLM) services. This campaign, which began in late December 2025, has seen over 91,000 attack…