Inside 90 days of attacks on AI infrastructure

What it is

Wiz Threat Research's 90-day honeypot findings on live attacks against self-hosted AI infrastructure (LiteLLM, Flowise, LangChain, Langflow, ChromaDB, Ollama, OpenWebUI, Node-RED). Beyond the CVE list, the value here is the concrete mechanism of each bug and the observable indicators — this document carries those.

How it works

LiteLLM MCP Gateway auth bypass (CVE-2026-59822): the flaw is in OAuth2 header handling. On failed token validation the server does not reject the request — it returns an empty UserAPIKeyAuth() object with no restrictions. Any Bearer token, even a single character, grants full MCP access.

MCP test-endpoint command injection (CVE-2026-42271, CISA KEV June 2026): the test endpoint spawns the configured MCP stdio server's command field via subprocess with no validation. Attackers submitted a fake stdio config whose command was a Python script that pulled and ran the gmon cryptominer, then returned a valid MCP handshake so the connection test appeared to succeed. Command output was exfiltrated back inside the description field of a fake tool in the tools/list response.

Fileless staging: the miner launches detached via start_new_session=True; the staging directory is deleted with rmtree while the running process keeps the binary's inode open — miner in memory, little left on disk.

Blind prompt injection: payloads instruct an agent to run an OS command via its shell tool, triggering a DNS query to an attacker OAST callback domain. The victim IP is encoded in the subdomain and a random per-session string maps each callback to a target — confirming execution without any output in the response.

Preconditions / Affected

Internet-reachable LiteLLM with the vulnerable MCP gateway/test endpoints; for full unauthenticated RCE, chain CVE-2026-42271 with Starlette host-header bypass CVE-2026-48710 (linked to Qilin ransomware). For prompt injection: any exposed agent (LangChain, Flowise, OpenWebUI, Node-RED) wired to a shell/execution tool that acts on external input.

What to do

The page gives detection signatures rather than patch commands. Hunt for probes using trivial Bearer tokens against model-enumeration endpoints:

GET /v1/models HTTP/1.1
Authorization: Bearer x

Alert on outbound DNS to OAST provider domains (e.g. *.oast.fun) from agent hosts. Treat any MCP config-test path that spawns a user-supplied command as RCE-equivalent — the failure mode is not LiteLLM-specific; any tool that verifies an MCP config by spawning the configured command shares it.

Caveats

The natural-language injection prompt was not captured; the IGNORE ALL PREVIOUS INSTRUCTIONS … oast.fun example is Wiz's reconstruction "consistent with the observed process," not a logged payload.