Hackers are no longer enough just to find an open AI service and run a miner on it. Attackers study the internal device of popular AI platforms, pull keys from the working processes, check the available models and mask malicious files under the usual directories of tools such as Claude Code. Wiz researchers saw similar attacks not in the lab, but on the real Internet, observing a specially deployed AI infrastructure for 90 days.
The Wiz Threat Research team has created honeypot environments with LitelLM, Flowise, LangChain, Langflow, ChromaDB, Ollama, and other components of modern AI stack. The traps made it possible to trace how automated scanners and real attackers are looking for vulnerable servers, use errors to execute commands remotely, implement instructions in AI agents, and move to further develop an attack within the compromised system.
One of the main goals was LiteLLM, a popular proxy gateway to work with several language model providers at once. Such a server can store OpenAI, Anthropic, Azure and Gemini API keys, have cloud IAM rights and connect to internal services through MCP. As a result, the hacking of one gateway is able to open access far beyond the LiteLLM itself.
The researchers recorded the exploitation of two MCP-related vulnerabilities. The Model Context Protocol allows AI agents to connect to databases, repositories, internal APIs, and other external tools. In LiteLLM, the CVE-2026-59822 error allowed you to bypass authentication in an unusually simple way. In case of unsuccessful verification of the token, the server instead of failure created an authorization object without restrictions. As a result, the attacker had enough of almost any Bearer token, including one symbol, to access MCP features.
The second vulnerability, CVE-2026-42271, was in the MCP server configuration verification mechanism. LiteLLM transmitted the user-defined command directly to execution without proper filtering. The attackers slipped the configuration with the Python script that the miner downloaded and started, and then returned the correct MCP response. For the administrator, the connection check looked successful while the system already worked a malicious process.
The authors of the campaign tried to leave as few traces as possible. The miner was launched as a separate process, after which the directory with the downloaded files was deleted. The working process continued to use the already open executable file, so there was less material on the disk for investigation.
Another class of attacks was already designed for the characteristics of AI agents. Wiz observed a blind prompt injection against LangChain, Flowise, OpenWebUI and Node-RED. The attackers tried to force the agent to execute the system command and turn to the controlled domain. Such a DNS request confirmed the successful execution of the instruction, even if the attacker did not see the AI system response.
The text of the malicious instruction was not intercepted by the researchers, so Wiz separately emphasizes that the example given in the report is a reconstruction. Telemetry at the same time showed a characteristic chain of processes and appeals to external infrastructure. After a successful check, the attackers loaded further commands through Pastebin, encoded the contents in Base64, and in some cases installed XMRig to mine Monero.
The most revealing part of the study began after the hacking of LiteLLM. Instead of the usual search for files with passwords, the attackers turned directly to the state of the modules of the working Python process and extracted the master key LiteLLM. This approach requires knowledge of the internal device of a particular platform, since an attacker needs to know where the application stores the desired value.
After gaining access, the attackers checked the LiteLLM configuration files and figured out which backend models are available through a proxy. Wiz found queries designed to define a specific model vendor. Such information helps to decide what is more profitable to do next, to steal the API key, to use someone else's quota for your own requests to the model or to move to other resources of the system.
The attackers adapted even the disguise under the AI-media. On one of the honeypot servers Langflow miner placed in the catalog .claude/, and the executable file was named unicorn. Catalogue .claude really used Claude Code, so a suspicious file is easier to lose among the components of legitimate AI tools.
Wiz's observations show a marked shift in attacks on AI infrastructure. Hackers are no longer limited to universal scanners and standard commands for Linux servers. In real campaigns, there are techniques designed for the architecture of LiteLLM, MCP, AI agents and specific ways of storing model keys.
For companies, such infrastructure becomes a particularly dangerous entry point. AI gateways often concentrate keys from multiple services at once, agents access internal tools, and some popular default projects can work without authentication. Wiz recommends treating internet-based AI services as a full-fledged critical cloud infrastructure, restricting their network rights, monitoring the launch of subsidiaries, and installing fixes immediately after the appearance without waiting for a scheduled service window.
The Wiz Threat Research team has created honeypot environments with LitelLM, Flowise, LangChain, Langflow, ChromaDB, Ollama, and other components of modern AI stack. The traps made it possible to trace how automated scanners and real attackers are looking for vulnerable servers, use errors to execute commands remotely, implement instructions in AI agents, and move to further develop an attack within the compromised system.
One of the main goals was LiteLLM, a popular proxy gateway to work with several language model providers at once. Such a server can store OpenAI, Anthropic, Azure and Gemini API keys, have cloud IAM rights and connect to internal services through MCP. As a result, the hacking of one gateway is able to open access far beyond the LiteLLM itself.
The researchers recorded the exploitation of two MCP-related vulnerabilities. The Model Context Protocol allows AI agents to connect to databases, repositories, internal APIs, and other external tools. In LiteLLM, the CVE-2026-59822 error allowed you to bypass authentication in an unusually simple way. In case of unsuccessful verification of the token, the server instead of failure created an authorization object without restrictions. As a result, the attacker had enough of almost any Bearer token, including one symbol, to access MCP features.
The second vulnerability, CVE-2026-42271, was in the MCP server configuration verification mechanism. LiteLLM transmitted the user-defined command directly to execution without proper filtering. The attackers slipped the configuration with the Python script that the miner downloaded and started, and then returned the correct MCP response. For the administrator, the connection check looked successful while the system already worked a malicious process.
The authors of the campaign tried to leave as few traces as possible. The miner was launched as a separate process, after which the directory with the downloaded files was deleted. The working process continued to use the already open executable file, so there was less material on the disk for investigation.
Another class of attacks was already designed for the characteristics of AI agents. Wiz observed a blind prompt injection against LangChain, Flowise, OpenWebUI and Node-RED. The attackers tried to force the agent to execute the system command and turn to the controlled domain. Such a DNS request confirmed the successful execution of the instruction, even if the attacker did not see the AI system response.
The text of the malicious instruction was not intercepted by the researchers, so Wiz separately emphasizes that the example given in the report is a reconstruction. Telemetry at the same time showed a characteristic chain of processes and appeals to external infrastructure. After a successful check, the attackers loaded further commands through Pastebin, encoded the contents in Base64, and in some cases installed XMRig to mine Monero.
The most revealing part of the study began after the hacking of LiteLLM. Instead of the usual search for files with passwords, the attackers turned directly to the state of the modules of the working Python process and extracted the master key LiteLLM. This approach requires knowledge of the internal device of a particular platform, since an attacker needs to know where the application stores the desired value.
After gaining access, the attackers checked the LiteLLM configuration files and figured out which backend models are available through a proxy. Wiz found queries designed to define a specific model vendor. Such information helps to decide what is more profitable to do next, to steal the API key, to use someone else's quota for your own requests to the model or to move to other resources of the system.
The attackers adapted even the disguise under the AI-media. On one of the honeypot servers Langflow miner placed in the catalog .claude/, and the executable file was named unicorn. Catalogue .claude really used Claude Code, so a suspicious file is easier to lose among the components of legitimate AI tools.
Wiz's observations show a marked shift in attacks on AI infrastructure. Hackers are no longer limited to universal scanners and standard commands for Linux servers. In real campaigns, there are techniques designed for the architecture of LiteLLM, MCP, AI agents and specific ways of storing model keys.
For companies, such infrastructure becomes a particularly dangerous entry point. AI gateways often concentrate keys from multiple services at once, agents access internal tools, and some popular default projects can work without authentication. Wiz recommends treating internet-based AI services as a full-fledged critical cloud infrastructure, restricting their network rights, monitoring the launch of subsidiaries, and installing fixes immediately after the appearance without waiting for a scheduled service window.
