AI Honeypot: Real Attacks on LiteLLM and MCP Servers Reveal Three Patterns

Wiz Threat Research operated honeypots on AI/ML services for 90 days and documented sustained attacks using tooling specifically adapted to the internals of each service. On August 27, 2026, the team published its findings: this is not generic probing, but targeted exploitation of orchestrators such as LiteLLM, LangChain, Flowise, and Ollama, with post-exploitation techniques that leverage the structure of the Python frameworks themselves. The stakes involve AI infrastructure that is now mainstream: according to the source, 90% of cloud environments run self-hosted AI software, 81% manage AI services, and 63% host self-hosted models.

Pattern One: RCE via MCP Server and the Bypass Chain

The first documented pattern exploits CVE-2026-42271, a command injection in the LiteLLM endpoints POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list. The vector passes through subprocess without validation: a Python payload downloads and executes the 'gmon' miner with start_new_session=True, removes the staging directory with rmtree, and maintains persistence via an open inode held in memory. Command output is returned via the description field in the tools/list response.

The chain becomes critical with CVE-2026-59822, an authentication bypass in the LiteLLM MCP Gateway: any Bearer token, including a single character 'x', returns an empty UserAPIKeyAuth() object with full MCP access. Wiz observed this behavior in honeypots with model enumeration probes. Chaining CVE-2026-42271 with CVE-2026-48710 (Starlette host header bypass), the report documents fully unauthenticated RCE.

"Over 90 days of telemetry, we observed sustained attack activity against AI infrastructure, with tooling adapted to the specific internals of each service" — Wiz Threat Research

Pattern Two: Blind Prompt Injection and OAST Exfiltration

The second pattern hits LangChain, Flowise, OpenWebUI, and Node-RED. These are prompts designed to execute OS commands with DNS callbacks to a threat actor-controlled domain (OAST), with an IP address encoded in the subdomain and a random string for session tracking. Subsequent payloads arrive from Pastebin, base64-encoded to bypass filters. This vector represents an evolution of the attack surface: no longer injection into the model itself, but against the agent framework that wraps it.

Wiz emphasizes that the blind prompt injection is reconstructed from process trees and DNS callbacks, not caught in the act with an intercepted payload. The XMRig deployment path at /usr/src/node-red/xmrig shows a masquerading technique within the Node.js process tree: the miner presents itself as a legitimate component of the infrastructure.

Pattern Three: Post-Exploitation That Speaks Python

The third pattern is post-exploitation specialized for AI environments. Instead of hunting for credential files on disk, attackers directly query the running Python module state to extract the master key from memory. The technique works because the key does not reside in a file but in the loaded module. From there, the attacker enumerates model backends for LLMjacking.

Specific configuration paths observed are /app/litellm_config.yaml, /etc/litellm/.env, and ~/.litellm/config.yaml. The camouflage reaches a refined level: on a Langflow honeypot, a miner was placed in /app/data/.claude/ and renamed 'unicorn'. The .claude/ directory is legitimate Claude Code configuration, so it raises no suspicion on an AI server.

"Rather than searching for credential files on disk, attackers queried the running process's Python module state directly to extract the master key from memory, since it doesn't exist in a file on the disk" — Wiz Threat Research

The Risk Geography: When AI Tooling Becomes Attack Surface

Exposure numbers are integral to the problem. Per the Wiz report, 57% of organizations deploy self-hosted AI agents, 80% adopt MCP servers, and 1 in 6 environments exposes at least one MCP server publicly. Of those, approximately 70% return tool catalogs anonymously and approximately 42% return real data. The combination of credential concentration in AI gateways and agent reachability in agent frameworks amplifies the impact of every single compromise.

The report links the Qilin ransomware group to active exploitation of the CVE-2026-42271/CVE-2026-48710 chain. The actual extent of Qilin compromise outside the honeypots is not quantified in the dossier.

Why It Matters

The dossier does not specify general remedial measures or mitigation frameworks beyond the 1.83.7 patch for CVE-2026-42271. It does not document specific recommendations for blind prompt injection or for post-exploitation from Python runtime state. The brief does not list secrets, SSH keys, source code, host filesystem, or credentials as exposed data categories: the source limits itself to documenting the extraction techniques and observed paths.

On the timeline, the 90-day period has no absolute start and end dates in the report; the conclusion is presumably near August 27, 2026. The June 8, 2026 CISA KEV addition date for CVE-2026-42271 relies solely on the Wiz source. For CVE-2026-48710 and CVE-2026-59822, the report is currently the only available source: no independently verified NVD records exist. The exact quantitative volume of attacks and the geolocation of attacker IPs are not specified.

The Wiz report does not cover the npm supply chain (keyv/cacheable), which is separate research. Not all MCP servers are configured for anonymous exposure: risk depends on the backend and active authentication.

FAQ

What is the "native-AI" post-exploitation documented by Wiz?

It is the use of techniques specific to the AI ecosystem: extraction of keys from in-memory Python module state, enumeration of LLM backends for LLMjacking, placement of malware in legitimate AI tooling directories (.claude/) for masquerading. It is not generic Linux post-exploitation: it is calibrated to the artifacts and processes of AI frameworks.

Why is mining relevant in a report on AI infrastructure?

Mining (gmon, XMRig) is the observed payload, but the vector is the point: RCE on AI orchestrators and prompt injection on agent frameworks. The choice of payload shows that attackers treat this infrastructure as any other computational surface, with the added advantage of credential concentration and model access.

What distinguishes the blind prompt injection in this report from known LLM attacks?

It does not target the model in conversation but the agent framework that orchestrates it (LangChain, Flowise, Node-RED). The payload is not visible to the end user but executes in the agent process context, with exfiltration via OAST DNS callbacks. The source reconstructs it from process trees and DNS logs, not from a payload intercepted live.

Sources

• https://www.wiz.io/blog/ai-infrastructure-honeypot
• https://nvd.nist.gov/vuln/detail/CVE-2026-42271
• https://www.wiz.io/reports/state-of-ai-in-the-cloud-2026
• https://www.wiz.io/blog/the-risk-hiding-behind-exposed-mcp-servers
• https://www.wiz.io/blog/keyv-and-cacheable-npm-supply-chain-attack

Information is based on the cited source and current as of publication.

Sources