Wiz researchers deployed honeypots over 90 days to observe active attack campaigns targeting AI infrastructure components including LiteLLM, MCP (Model Context Protocol) servers, and various AI frameworks. Attackers were observed exploiting Remote Code Execution (RCE) vulnerabilities, conducting blind prompt injection attacks, and stealing credentials from memory. The research highlights that AI infrastructure is increasingly being targeted by threat actors as adoption grows. Key attack vectors include exploitation of exposed AI management interfaces, prompt injection against LLM proxies, and credential harvesting from AI workloads. The findings underscore the need for securing AI-specific infrastructure with the same rigor applied to traditional systems.
Wiz Threat Research operated honeypots across AI/ML services (LiteLLM, Flowise, LangChain, Langflow, ChromaDB, Ollama) for 90 days and observed three main attack patterns: 1. MCP Server Exploitation: Attackers exploited CVE-2026-59822, an authentication bypass in LiteLLM's MCP Gateway where failed token validation returns an empty unrestricted UserAPIKeyAuth() object instead of rejecting the request, allowing any Bearer token (even a single character like 'x') to gain full MCP access. A separate command injection vulnerability (CVE-2026-42271) in LiteLLM's MCP server test endpoints allowed attackers to inject Python scripts into the command field (passed directly to subprocess with no validation) to download and execute a cryptominer from 185.62.1.8, disguised as a valid MCP handshake. CVE-2026-42271 can be chained with a Starlette host header validation bypass (CVE-2026-48710) for fully unauthenticated RCE. The Qilin ransomware group has been linked to active exploitation of this chain. 2. Blind Prompt Injection: Attacks against LangChain, Flowise, OpenWebUI, and Node-RED injected instruction-override prompts directing agents to execute OS commands (e.g., ping to attacker-controlled OAST callback domains to confirm execution). Payloads were fetched from Pastebin post-confirmation and delivered base64-encoded to bypass filtering. Successful sessions deployed XMRig at /usr/src/node-red/xmrig. 3. AI-Native Post-Exploitation: Attackers queried LiteLLM's running Python module state directly to extract master keys from memory (not from disk files) using 'import litellm.proxy.proxy_server as ps'. They enumerated AI-specific config paths (/app/litellm_config.yaml, /etc/litellm/.env, ~/.litellm/config.yaml), tested default credentials (sk-1234), fingerprinted backend model providers via chat completions API, and used AI-themed camouflage (e.g., staging miners at /app/data/.claude/ and renaming binaries to 'unicorn' on Langflow hosts). The miner binary on LiteLLM/MCP campaign was staged in /tmp/.dbus-cache/, launched detached via start_new_session=True, and staging directory removed post-launch to reduce disk artifacts.
1. Inventory the AI stack: Treat every AI tool, model, and framework deployed in cloud environments (self-hosted or managed) as first-class production infrastructure with owners, monitoring, and a security review pipeline. 2. Require authentication by default: Most AI tools (Marimo, Flowise, Langflow, Ollama, ChromaDB, Milvus, etc.) ship unauthenticated. Treat any unauthenticated internet-facing AI service as already compromised. 3. Restrict lateral reach: Scope IAM permissions narrowly for AI proxies that aggregate credentials, block outbound network egress where possible, and treat all MCP-connected services as inside the blast radius of any future compromise — harden them as though internet-facing. 4. Monitor at the runtime layer: Use process-ancestry monitoring to detect AI servers spawning shells, which catches exploitation regardless of entry vector. 5. Patch proactively: For open-source AI infrastructure, attackers often weaponize vulnerabilities as soon as fixes appear in code, ahead of CVE assignment. Maintain awareness of new vulnerabilities in parallel with attackers and patch internet-facing infrastructure immediately rather than waiting for maintenance cycles. 6. Apply specific patches: Patch CVE-2026-59822 (LiteLLM MCP Gateway auth bypass), CVE-2026-42271 (LiteLLM MCP command injection, added to CISA KEV June 2026), and CVE-2026-48710 (Starlette host header bypass) immediately. 7. Change default credentials: Immediately change any default LiteLLM master keys (e.g., sk-1234). 8. Monitor for IOCs: Block/alert on the listed malicious IPs, domains, and file paths in security tooling.
185.62.1.8 - Malware download server (LiteLLM/MCP campaign), 185.84.98.85 - Cryptominer C2, pool.hashvault.pro - Monero mining pool (multiple campaigns), crazyeltonproxy.top - Monero mining proxy (LangChain + Node-RED), 94.26.106.29 - Langflow binary staging, 1710.rwlp.be - Compromised WordPress site, binary staging, /tmp/.dbus-cache/ - Cryptominer staging directory, /tmp/.dbus-cache/gmon - Monero miner binary, /tmp/x86_64 - Langflow dropper (self-deletes), /tmp/amd64 - Langflow dropper (self-deletes), /usr/src/node-red/xmrig - XMRig miner deployment path, /app/data/.claude/ - Miner staging path on Langflow (camouflage), unicorn - Renamed miner binary (camouflage on Langflow), http://185.62.1.8/mon/mon.zip - Cryptominer download URL, ugrzyyzfxobsrsxcvmwggaobkatyxff4n.oast.fun - OAST callback domain for blind prompt injection confirmation, Authorization: Bearer x - Single-character token used to exploit CVE-2026-59822, echo ZWNobyBsd2hmdyAyPiYxO2NobW9kIDc3NyAvdmFyL3RtcC9kb2NrZXIgMj4mMTtlY2hvIGtmOWV1eiAyPiYx | base64 -d | bash -i - Base64-encoded payload observed in Node-RED attacks
