Hackers are actively probing AI systems, turning exposed gateways and agent tools into routes for remote code execution, credential theft, and cryptomining. AI infrastructure is now a cloud entry point.
Over 90 days, attackers tailored techniques for services routing model traffic and connecting agents to tools. Campaigns paired exposed-server flaws with instructions that push agents to run commands and seek API keys.
Researchers at Wiz.io identified sustained activity through honeypots mimicking AI services. They covered LiteLLM, MCP servers, LangChain, Flowise, Langflow, OpenWebUI, and Node-RED, showing tailored intrusion methods.
Wiz.io said in a report shared with Cyber Security News (CSN) that the impact can extend beyond one compromised application. AI proxies may centralize keys and cloud permissions. A weak deployment can become a bridge to data, paid model usage, and deeper systems.
Hackers Target AI Infrastructure With RCE
One campaign targeted internet-facing Model Context Protocol, or MCP, services. MCP lets an agent call databases, code repositories, messaging platforms, and internal APIs.
That expands the damage from a gateway takeover, as shown in reporting on AI agent pipeline compromise. Attackers exploited LiteLLM flaws CVE-2026-59822, an MCP Gateway authentication bypass, and CVE-2026-42271, command injection in test endpoints. The first could accept a one-character bearer token for MCP functions.
For the second flaw, attackers submitted a fake MCP server configuration whose command field launched a Python downloader and cryptominer. The test returned a believable handshake. CVE-2026-42271 can be chained with CVE-2026-48710, a Starlette host-header bypass, for unauthenticated RCE.
External researchers associated the exploitation chain with the Qilin ransomware group. Any exposed tool that starts a configured command to validate an MCP connection can become dangerous.
The campaigns also show why AI security cannot be separated from ordinary infrastructure security. A model gateway can sit between users, cloud accounts, paid services, and internal tools, so an apparently minor configuration problem can carry enterprise-wide consequences.
Security teams need to assess the permissions attached to agents and proxies, rather than considering only the model or the application interface. That review should include every connected tool, secret, network path, and approval step.
Another set of attacks used blind prompt injection against agent frameworks. Intruders inserted instructions to make an agent with shell access run a command.
A DNS lookup confirmed execution without exposing output. Similar dangers appear in prompt injection security research, where untrusted text is mistaken for a trusted instruction.
Observed sessions retrieved payloads from Pastebin and used Base64-encoded commands, reducing visibility in logs and basic filters. Successful compromises deployed XMRig on Node-RED systems. Giving an agent shell access should be treated as a high-risk design choice.
API Keys Become the Prize
On LiteLLM, they queried the running Python process to recover the proxy master key from memory, where it may not exist in a normal file. They also checked configuration paths and listed backend models before choosing targets for key theft or capacity abuse.
This behavior turns AI gateways into credential stores. An exposed proxy can hold access for multiple model providers, while cloud permissions and MCP services widen impact.
Recent coverage of AI security tools hijacked likewise shows how a trusted agent can become an avenue to unauthorized systems when it processes hostile input.
.webp)
Attackers also selected names and directories that blend into AI environments. In one Langflow case, the miner was staged inside a hidden .claude directory and renamed unicorn.
Administrators may mistake it for development tooling, much as hidden commands target AI shows with directions concealed in content an agent reads.
Organizations should inventory AI services, assign ownership, and require authentication before exposure. They should limit permissions and outbound access, treat MCP services as one exposure zone, and patch quickly.
Runtime monitoring is also vital. Alerts for AI servers spawning shells, downloading archives, or launching unexpected processes can catch abuse. Teams should rotate exposed credentials, examine logs, and investigate the indicators below.
Indicators of compromise (IoCs):-
| Type | Indicator | Description |
|---|---|---|
| IP address | 185.62.1[.]8 | Malware download server in the LiteLLM/MCP campaign |
| IP address | 185.84.98[.]85 | Cryptominer command-and-control server |
| Domain | pool.hashvault[.]pro | Monero mining pool used across multiple campaigns |
| Domain | crazyeltonproxy[.]top | Monero mining proxy linked to LangChain and Node-RED activity |
| IP address | 94.26.106[.]29 | Langflow binary-staging server |
| Domain | 1710.rwlp.be | Compromised WordPress site used for binary staging |
| File path | /tmp/.dbus-cache/ | Cryptominer staging directory |
| File path | /tmp/.dbus-cache/gmon | Monero miner binary |
| File path | /tmp/x86_64, /tmp/amd64 | Langflow dropper paths that self-delete |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC
