Threat actors are increasingly targeting exposed AI infrastructure to steal model-provider API keys, abuse cloud-connected services, and deploy Monero cryptominers, according to new research from Wiz Threat Research.
Wiz monitored honeypots designed to imitate commonly deployed AI and machine-learning services for 90 days, including LiteLLM, Flowise, LangChain, Langflow, ChromaDB, Ollama, and other platforms.
The researchers found attackers adapting their tools and post-exploitation activity to the internals of individual AI services.
The activity shows that AI infrastructure is becoming a valuable cloud attack surface. These platforms often hold high-value credentials, connect to internal tools, process untrusted input, and may have permissions to access cloud services.
A compromised AI proxy can potentially expose keys for providers such as OpenAI, Anthropic, Azure, and Gemini.
Hackers Raid AI Servers
The first attack pattern involved exposed Model Context Protocol (MCP) servers. MCP allows AI agents to communicate with databases, code repositories, internal APIs, Slack, and other external tools.
Wiz observed exploitation attempts against LiteLLM’s MCP components. One issue, tracked as CVE-2026-59822, allowed an authentication bypass caused by faulty OAuth2 header handling. Attackers used a minimal Bearer token, such as x, to probe model-enumeration endpoints.
A second flaw, CVE-2026-42271, affected LiteLLM MCP server test endpoints. Attackers could inject commands into a server configuration, causing the application to execute a malicious Python payload.
The payload downloaded a cryptominer, launched it in the background, removed the staging folder, and returned a legitimate-looking MCP handshake response.
This technique leaves limited evidence on disk because the miner continues running after its files are deleted. Researchers also noted that the vulnerability could be chained with CVE-2026-48710, a Starlette host-header validation bypass, for unauthenticated remote code execution.
The second pattern was blind prompt injection. Attackers sent malicious instructions to AI agent frameworks, including LangChain, Flowise, OpenWebUI, and Node-RED.
The prompts attempted to make an agent invoke a shell or command-execution tool.
Instead of directly receiving command output, attackers used DNS callbacks to attacker-controlled domains to confirm that their prompt had executed.
They then downloaded payloads from external hosting services and deployed XMRig miners. In one case, a miner was placed under /usr/src/node-red/xmrig to blend into a Node.js environment.
The third pattern involved post-exploitation tailored to AI platforms. Rather than only searching for SSH keys or cloud credential files, attackers looked for model-provider API keys, LiteLLM master keys, framework configuration files, and accessible backend models.
On compromised LiteLLM systems, attackers queried Python module memory to retrieve the running application’s master key.
They also checked common configuration locations such as /app/litellm_config.yaml, /etc/litellm/.env, and ~/.litellm/config.yaml, Wiz said.
Indicators of Compromise
| Indicator | Type | Description |
|---|---|---|
185.62.1[.]8 | IP address | Malware download server linked to the LiteLLM/MCP cryptomining campaign |
185.84.98[.]85 | IP address | Cryptominer command-and-control infrastructure |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Detect, investigate, and respond faster with in-browser data inspection from ANY.RUN-> Power your SOC with ANY.RUN
