For more than three months, attackers have systematically probed exposed AI infrastructure, turning model gateways, agent frameworks, and tool connectors into reliable entry points for remote code execution, credential theft, and cryptomining. The campaigns, tracked by cloud security researchers at Wiz.io through a network of honeypots designed to mimic real AI services, reveal that the threat landscape has shifted. AI infrastructure is no longer just an asset to be protected; it has become a primary vector for cloud compromise.
The findings, published in a detailed report shared with Cyber Security News, document a sustained and methodical pattern of exploitation. Over a 90-day observation period, threat actors tailored their techniques for specific AI services, exploiting exposed servers, weak authentication, and the inherent trust models of agent-based systems. The campaigns targeted a broad array of popular open-source and commercial tools, including LiteLLM, Model Context Protocol (MCP) servers, LangChain, Flowise, Langflow, OpenWebUI, and Node-RED. The goal was consistent: achieve initial access, then pivot to steal API keys, deploy cryptominers, and establish persistent command-and-control.
Wiz.io warned that the impact of a single compromised AI application can ripple far beyond the initial breach. AI proxies and gateways, by design, centralize access to model APIs, cloud permissions, and internal data stores. A weakly configured deployment becomes a bridge to sensitive data, paid model usage, and deeper infrastructure. This is the core strategic shift that security teams must now internalize. The attack surface is no longer the model itself, but the entire operational stack that supports it.
How Hackers Weaponize LiteLLM and MCP for Remote Code Execution
One of the most significant campaigns identified by Wiz.io focused on internet-facing Model Context Protocol services. MCP is a protocol that allows AI agents to interface directly with external tools and data sources, such as databases, code repositories, messaging platforms, and internal APIs. This integration, while powerful, dramatically expands the blast radius of a gateway takeover. An attacker who gains control of an MCP server can instruct the agent to execute arbitrary actions across connected systems, effectively weaponizing the agent against its own enterprise environment.
The researchers observed attackers specifically exploiting two vulnerabilities in LiteLLM, a popular open-source proxy for managing access to hundreds of large language models. The first flaw, tracked as CVE-2026-59822, is an authentication bypass in the MCP gateway. This vulnerability allowed attackers to send requests to the proxy using a single-character bearer token, effectively granting unfettered access to MCP functions without valid credentials. The second, CVE-2026-42271, is a command injection vulnerability residing in test endpoints used to validate MCP server connections.
Attackers chained these vulnerabilities together with devastating effect. By exploiting the authentication bypass, they submitted a malicious MCP server configuration. The configuration file contained a command field that, when executed by the LiteLLM proxy to validate the connection, launched a Python downloader script. That script then pulled a cryptominer payload from a remote server. The entire process appeared legitimate to the system, as the test endpoint returned a believable handshake response. The researchers further noted that CVE-2026-42271 can be chained with CVE-2026-48710, a Starlette host-header bypass, to achieve unauthenticated remote code execution from the internet, raising the severity even higher.
External threat intelligence linked this specific exploitation chain to the Qilin ransomware group. This connection is critical because it demonstrates that established cybercriminal enterprises are now actively investing in AI-specific attack capabilities. Any AI tool that accepts a configured command to validate an MCP connection should be treated as a high-risk deployment.
Blind Prompt Injection Turns Agents Into Malicious Executors
Beyond exploiting software vulnerabilities, the campaigns revealed a sophisticated use of blind prompt injection against agent frameworks. In these attacks, the intruders did not need to compromise the underlying server software directly. Instead, they injected instructions into text that the AI agent was processing. When the agent, designed to act on user input, encountered these hidden commands, it faithfully executed them as if they were legitimate instructions.
Wiz.io observed instances where attackers inserted commands instructing the agent to run shell commands. Because the injection was “blind,” meaning the attacker did not see the output of the execution, they used a DNS lookup as a verification channel. A successful command execution triggered a DNS request to a domain they controlled, confirming the infection without exposing the payload in system logs. This technique is a known challenge in AI security, where untrusted text is often indistinguishable from a trusted directive by the model itself.
Observed sessions showed attackers retrieving payloads from Pastebin and using Base64-encoded commands to reduce visibility in standard security filters. The end goal was often the same: deploying the XMRig cryptominer on compromised systems running Node-RED, LangChain, or Langflow. In one illustrative case on a Langflow server, the miner was staged inside a hidden directory named .claudecodecodecodecode and the binary itself was renamed to unicorncodecodecodecode. This deliberate naming convention is designed to blend in with legitimate development tooling, making it difficult for administrators to spot during casual inspection. Granting an AI agent direct shell access is no longer a design choice; it is a significant security risk that demands compensating controls.
API Keys Become the Primary Prize in AI Infrastructure Attacks
The persistent theme across all observed campaigns was the theft of API keys. On compromised LiteLLM proxies, attackers specifically queried the running Python process to recover the proxy master key directly from memory, where it may not exist in a standard file that would be caught by file integrity monitoring. They also checked configuration file paths and listed available backend models, allowing them to prioritize targets for key theft or to simply abuse capacity for generating content or running queries at the victim’s expense.
This behavior transforms AI gateways from simple access points into high-value credential stores. A single exposed proxy can hold access keys for multiple model providers, including OpenAI, Anthropic, Google, and others. The cloud permissions attached to the host environment further compound the risk. An attacker who steals an API key can use it not only to drain accounts but also to probe for privilege escalation into the cloud provider account itself. This is the connection that elevates an AI infrastructure attack from a nuisance to a full-scale cloud compromise. Recent coverage of AI security tools being hijacked illustrates the same principle: when a trusted agent processes hostile input, it can become an open avenue to unauthorized systems.
Mitigating the Threat: Practical Steps for Protecting AI Infrastructure
The campaigns documented by Wiz.io make a single, overriding point clear: AI security cannot be separated from ordinary infrastructure security. A model gateway sits directly between users, cloud accounts, paid services, and internal tools. An apparently minor configuration problem, such as a weak authentication token or an exposed test endpoint, can carry enterprise-wide consequences.
Security teams need to reassess the permissions attached to every agent and proxy. This review must include every connected tool, stored secret, network path, and approval step. The following practical measures are directly supported by the observed attack patterns:
- Inventory and ownership: Organizations should create a complete inventory of all AI services, assign clear ownership, and require authentication before any service is exposed to a network. Unknown or forgotten deployments are primary targets.
- Limit permissions and outbound access: AI proxies should operate with the minimum necessary permissions. Outbound network access should be restricted to approved endpoints (e.g., the specific model provider APIs). Cryptominers rely on outbound connections to mining pools.
- Treat MCP services as a high-risk exposure zone: Any service implementing the Model Context Protocol should receive additional scrutiny. The ability to connect agents to arbitrary internal and external tools dramatically increases the risk of a gateway takeover.
- Patch aggressively: The documented exploits for LiteLLM (CVE-2026-59822, CVE-2026-42271, CVE-2026-48710) demonstrate that vulnerabilities are being weaponized quickly. A patch management cycle for AI infrastructure must be as rigorous as for traditional servers.
- Implement runtime monitoring: Security teams should create alerts specifically for AI servers spawning shell processes, downloading archives, or launching unexpected applications. An AI server that suddenly runs a Python downloader is a clear indicator of compromise.
Wiz.io provided a set of indicators of compromise observed across the campaigns. Security operations centers should ingest these into their detection and response platforms.
Indicators of Compromise (IoCs):
| Type | Indicator | Description |
|---|---|---|
| IP address | 185.62.1[.]8codecodecodecode |
Malware download server in the LiteLLM/MCP campaign |
| IP address | 185.84.98[.]85codecodecodecode |
Cryptominer command-and-control server |
| Domain | pool.hashvault[.]procodecodecodecode |
Monero mining pool used across multiple campaigns |
| Domain | crazyeltonproxy[.]topcodecodecodecode |
Monero mining proxy linked to LangChain and Node-RED activity |
| IP address | 94.26.106[.]29codecodecodecode |
Langflow binary-staging server |
| Domain | 1710.rwlp.becodecodecodecode |
Compromised WordPress site used for binary staging |
| File path | /tmp/.dbus-cache/codecodecodecode |
Cryptominer staging directory |
| File path | /tmp/.dbus-cache/gmoncodecodecodecode |
Monero miner binary |
| File path | /tmp/x86_64codecodecodecode, /tmp/amd64codecodecodecode |
Langflow dropper paths that self-delete |
The three-month observation period from Wiz.io is a clear signal. The era when AI security was a theoretical or peripheral concern is over. Adversaries have already adapted, and they are using the very features built for efficiency and integration as weapons against their hosts. Teams should move beyond securing only the model and begin treating the entire AI infrastructure stack as a critical, high-value, and actively targeted attack surface. The connection between a misconfigured gateway and a full cloud compromise is no longer hypothetical; it is the new baseline for operational risk.
