Wiz Honeypots Record 90 Days of Attacks Written Specifically for AI Stack Internals

Wiz Threat Research honeypots running LiteLLM, Flowise, LangChain, Langflow, ChromaDB, Ollama, and other AI and ML services

Wiz published 90 days of honeypot telemetry showing attackers who understand the software they are attacking rather than scanning it generically. Three exploitation paths dominated: MCP server remote code execution, blind prompt injection in which instructions are planted in requests to trigger agent tool execution with no visible response, and AI-native post-exploitation. Two LiteLLM flaws carried the campaigns. CVE-2026-59822 is an authentication bypass in which a fabricated Authorization header triggers a faulty OAuth2 fallback, so token validation failure returns an unrestricted `UserAPIKeyAuth()` object and any bearer token, down to a single character, reaches MCP tooling. CVE-2026-42271 is command injection in LiteLLM's MCP server test endpoints, where a supplied `command` field is passed to subprocess execution without validation, affecting versions 1.74.2 through 1.83.6 and fixed in 1.83.7; chained with CVE-2026-48710, a Starlette host-header validation bypass, it becomes unauthenticated remote code execution. The post-exploitation tradecraft was the notable part: attackers pulled master keys out of Python module memory rather than searching the filesystem for them, staged XMRig in directories named to blend with agent tooling such as `/app/data/.claude/`, and base64-encoded payloads fetched from Pastebin after compromise to keep them out of application logs. Wiz frames the exposure with its own figure that 90% of cloud environments run self-hosted AI software

AI gateways and orchestration services hold provider API keys, database credentials, and execution privileges in one process, and are routinely deployed to the internet with authentication that fails open. The attacker skill shift is that reconnaissance, credential theft, and payload camouflage are now tailored to the internals of specific AI frameworks