Attackers are adapting their tradecraft to AI infrastructure, not just scanning it like another web service.
Wiz Threat Research said its 90-day honeypot operation captured sustained attacks against LiteLLM, Model Context Protocol (MCP) servers, LangChain, Flowise, Langflow, OpenWebUI, Node-RED, and other AI services. The activity included LiteLLM exploitation, cryptocurrency mining, blind prompt injection, and attempts to pull credentials from running AI systems.
AI gateways can hold model-provider keys, cloud permissions, and connections to internal systems through MCP. Wiz’s honeypot research showed attackers targeting those relationships after initial access, while other recent intrusions have shown AI being used during real-world attacks for reconnaissance, exploitation, credential theft, and post-compromise decision-making.
LiteLLM flaws open two attack paths
LiteLLM routes requests across multiple large language model providers, making it a useful target when MCP connections expose additional tools or internal resources.
One attack path involved CVE-2026-59822, a high-severity authentication bypass affecting LiteLLM versions before 1.84.0. Faulty OAuth2 passthrough handling allowed an arbitrary Bearer token to reach configured MCP functionality without a valid LiteLLM key. Wiz observed attackers using even single-character tokens to probe exposed services. Similar MCP-based credential theft research has shown how compromised integrations can expose OAuth tokens and connected SaaS services.
Separately, attackers exploited CVE-2026-42271, an authenticated command-execution flaw affecting LiteLLM versions 1.74.2 through versions before 1.83.7. MCP test endpoints could spawn attacker-controlled commands as subprocesses on the LiteLLM host. In Wiz’s honeypots, attackers used the weakness to launch a Python downloader and install a cryptocurrency miner.
The miner ran as a detached process while its staging directory was deleted, reducing evidence left on disk. The broader campaign also included blind prompt-injection attempts against other AI frameworks, with attackers using outbound DNS requests to determine whether commands executed when output was not directly visible.
AI gateways concentrate risk
The immediate priority is closing known vulnerabilities while reducing what a compromised gateway can reach. AI development tools, including MCP servers, are increasingly part of the software supply chain and can carry access to code, credentials, and CI/CD environments.
Organizations should:
- Patch LiteLLM promptly. Upgrade to 1.84.0 or later and confirm dependent applications are not pinning vulnerable releases.
- Restrict MCP and administrative endpoints. Disable unused routes, limit test interfaces to trusted users, and avoid unnecessary public exposure.
- Place gateways behind network controls. Use reverse proxies, WAFs, VPNs, or private load balancers to reduce direct access.
- Apply least privilege and segmentation. Limit provider keys, cloud roles, service accounts, and MCP tool permissions, and isolate AI systems from sensitive infrastructure.
- Control outbound traffic. Restrict unnecessary DNS and HTTP connections and alert on unusual callbacks, payload downloads, or model enumeration.
- Hunt for process and credential abuse. Investigate suspicious child processes, deleted staging directories, abnormal MCP requests, and attempts to retrieve credentials from memory.
- Test incident response plans for AI infrastructure. Validate isolation, credential rotation, MCP-service review, cloud and API log analysis, and downstream access checks.
For security teams, a compromised gateway should trigger review of every credential, MCP connection, and downstream service it could reach — not just the LiteLLM host itself.
Wiz also observed attackers querying LiteLLM’s running Python process for its master key and fingerprinting available model backends. Defenders should account for credentials and connections exposed through memory and runtime state, not only files on disk.
AI gateways should be treated as privileged infrastructure. Limiting their exposure, permissions, and connectivity can reduce how far an attacker moves after compromise.
Read more: Recent TeamPCP arrests show how compromises of trusted developer tooling can lead to large-scale credential theft across the software supply chain.