Wiz Details 90 Days of Attacks on AI Infrastructure
Summary
Wiz says honeypots observed attackers exploiting exposed AI services, using blind prompt injection against agents, and adapting post-exploitation to steal AI credentials and deploy cryptominers.
Key points
- Wiz observed sustained attacks on AI and ML services during 90 days of honeypot telemetry.
- Attackers exploited LiteLLM MCP gateway authentication bypass and command injection flaws; the latter enabled cryptominer deployment.
- Wiz reports the command injection flaw was chained with a Starlette host-header validation bypass for unauthenticated RCE; researchers linked Qilin to active exploitation of the chain.
- Prompt injections against AI agents used DNS callbacks to confirm shell-command execution, followed by payload retrieval and XMRig deployment.
- Post-exploitation activity included extracting LiteLLM keys from process memory, checking framework-specific configuration paths, and identifying accessible backend models.
- Wiz recommends inventorying AI infrastructure, requiring authentication, limiting permissions and network reach, monitoring runtime process behavior, and patching promptly.
Article Details
- Attack Vectors
- Exploitation of internet-facing LiteLLM MCP servers through an authentication bypass (CVE-2026-59822) and command injection in MCP server test endpoints (CVE-2026-42271); the latter was reportedly chained with a Starlette host header validation bypass (CVE-2026-48710) for unauthenticated remote code execution.
- Blind prompt injection against LangChain, Flowise, OpenWebUI, and Node-RED deployments to induce agents with shell tools to execute commands and make DNS callbacks.
- Post-exploitation of AI infrastructure to extract credentials from LiteLLM Python module state, enumerate model backends and configuration paths, and deploy or conceal cryptominers.
- Defensive Notes
- Inventory AI tools, models, and frameworks as production infrastructure, with assigned owners, monitoring, and security review.
- Require authentication by default and patch internet-facing AI infrastructure promptly.
- Scope IAM permissions narrowly and restrict outbound network egress where possible; treat MCP-connected services as within the blast radius of a compromise.
- Monitor process ancestry and anomalous runtime behavior, such as an AI server spawning a shell.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | 1710[.]rwlp[.]be | Compromised WordPress site used for binary staging. |
| DOMAIN | crazyeltonproxy[.]top | Monero mining proxy used in the LangChain and Node-RED activity. |
| DOMAIN | pool[.]hashvault[.]pro | Monero mining pool used by multiple campaigns. |
| IPV4 | 185[.]62[.]1[.]8 | Malware download server for the LiteLLM/MCP campaign. |
| IPV4 | 185[.]84[.]98[.]85 | Cryptominer command-and-control server. |
| IPV4 | 94[.]26[.]106[.]29 | Langflow binary staging server. |
| URL | hxxp[:]//185[.]62[.]1[.]8/mon/mon[.]zip | Specific cryptominer archive download URL used in the LiteLLM/MCP campaign. |
MITRE ATT&CK
T1059.004 · Unix ShellInjected agent instructions and the base64-decoded payload caused shell commands to run.T1059.006 · PythonA Python script delivered through the MCP command-injection vulnerability downloaded and launched the cryptominer.T1071.004 · DNSA DNS query to an attacker-controlled callback domain was used to confirm command execution.T1105 · Ingress Tool TransferThe attacker’s Python script downloaded a cryptominer archive from the listed malware server.T1190 · Exploit Public-Facing ApplicationAttackers exploited vulnerabilities in internet-facing LiteLLM MCP endpoints.T1496.001 · Compute HijackingDeployed Monero miners used compromised AI infrastructure for cryptocurrency mining.
CVE
CVE-2026-42271attackers exploited a command injection vulnerability in LiteLLM's MCP server test endpoints (CVE-2026-42271, added to CISA KEV in June 2026). These endpoints allow users to test MCP server configurationsCVE-2026-48710CVE-2026-42271 can be chained with a Starlette host header validation bypass (CVE-2026-48710) to achieve fully unauthenticated RCE. External researchers have linked the Qilin ransomware group to active exploitation ofCVE-2026-59822Earlier this year, Wiz Research discovered an authentication flaw in LiteLLM's MCP Gateway (CVE-2026-59822). The vulnerability sits in the OAuth2 header handling: when token validation fails, rather than rejecting the
Threat Actors
Malware
Products
ChromaDBResearch operates honeypots across AI and ML services including LiteLLM, Flowise, LangChain, Langflow, ChromaDB, Ollama, and others. Over 90 days of telemetry, we observed sustained attack activity against AIFlowiseWiz Threat Research operates honeypots across AI and ML services including LiteLLM, Flowise, LangChain, Langflow, ChromaDB, Ollama, and others. Over 90 days of telemetry, we observed sustained attack activity against AILangChainWiz Threat Research operates honeypots across AI and ML services including LiteLLM, Flowise, LangChain, Langflow, ChromaDB, Ollama, and others. Over 90 days of telemetry, we observed sustained attack activity against AILangflowWiz Threat Research operates honeypots across AI and ML services including LiteLLM, Flowise, LangChain, Langflow, ChromaDB, Ollama, and others. Over 90 days of telemetry, we observed sustained attack activity against AILiteLLMWiz Threat Research operates honeypots across AI and ML services including LiteLLM, Flowise, LangChain, Langflow, ChromaDB, Ollama, and others. Over 90 days of telemetry, we observed sustained attack activity against AIMarimoMost AI tools ship unauthenticated (Marimo, Flowise, Langflow, Ollama, ChromaDB, Milvus, and others).MilvusMost AI tools ship unauthenticated (Marimo, Flowise, Langflow, Ollama, ChromaDB, Milvus, and others).Node-REDAttacks across LangChain, Flowise, OpenWebUI, and Node-RED deployments injected prompts designed to make an agent execute an OS command. If the agent had a shell tool and ran it, a DNS query would fire to anOllamaoperates honeypots across AI and ML services including LiteLLM, Flowise, LangChain, Langflow, ChromaDB, Ollama, and others. Over 90 days of telemetry, we observed sustained attack activity against AI infrastructure,OpenWebUIAttacks across LangChain, Flowise, OpenWebUI, and Node-RED deployments injected prompts designed to make an agent execute an OS command. If the agent had a shell tool and ran it, a DNS query would fire to anStarletteCVE-2026-42271 can be chained with a Starlette host header validation bypass (CVE-2026-48710) to achieve fully unauthenticated RCE. External researchers have linked the Qilin ransomware group to active exploitation of