Hackers Launch Sophisticated Attacks on AI Infrastructure With RCE and API Key Compromise

Threat actors are increasingly targeting AI infrastructure, transforming exposed gateways and agent frameworks into entry points for remote code execution (RCE), credential theft, and cryptocurrency mining operations. As AI deployments become deeply integrated with cloud environments, AI infrastructure is emerging as a valuable target for cybercriminals.

Over a 90-day observation period, researchers documented campaigns specifically designed to compromise services that route AI model traffic and connect agents to external tools. These attacks combined vulnerabilities in exposed servers with malicious instructions crafted to force AI agents into executing commands and searching for sensitive API credentials.

Security researchers at Wiz.io identified sustained attack activity through a network of honeypots that emulated popular AI services, including LiteLLM, Model Context Protocol (MCP) servers, LangChain, Flowise, Langflow, OpenWebUI, and Node-RED. Their findings revealed customized intrusion techniques tailored to each platform.

According to a report shared by Wiz.io with Cyber Security News, the consequences of a compromised AI application can extend far beyond a single system. AI proxies often centralize access to API keys, cloud permissions, and connected services, meaning a vulnerable deployment can become a gateway to sensitive data, paid AI resources, and broader enterprise environments.

Remote Code Execution Targets AI Gateways

One of the most notable campaigns focused on internet-exposed Model Context Protocol (MCP) services. MCP enables AI agents to interact with databases, source code repositories, messaging systems, and internal APIs. As a result, compromising an MCP gateway can provide attackers with access to a wide range of connected resources.

Researchers observed exploitation of multiple LiteLLM vulnerabilities, including:

• CVE-2026-59822: An MCP Gateway authentication bypass that allowed attackers to access MCP functions using a single-character bearer token.
• CVE-2026-42271: A command injection vulnerability in testing endpoints.

Using the command injection flaw, attackers supplied a malicious MCP server configuration containing a command that launched a Python-based downloader and cryptocurrency miner. The test process returned a seemingly legitimate handshake, masking the intrusion attempt.

Researchers noted that CVE-2026-42271 could also be chained with CVE-2026-48710, a Starlette host-header bypass vulnerability, enabling unauthenticated remote code execution.

External researchers have linked this exploitation chain to activity associated with the Qilin ransomware group. The findings highlight the risks posed by any exposed service that automatically executes configured commands to verify MCP connections.

Prompt Injection Used as an Attack Vector

The investigation also uncovered attacks leveraging blind prompt injection against AI agent frameworks. Adversaries embedded malicious instructions designed to trick agents with shell access into executing operating system commands.

Attackers frequently used DNS lookups to verify successful execution without revealing output, providing a stealthy method for validating compromises. This technique demonstrates how untrusted content can be interpreted as trusted instructions, creating opportunities for exploitation.

Observed attack sessions retrieved payloads from services such as Pastebin and relied on Base64-encoded commands to evade detection by logging systems and security tools. In several instances, successful intrusions resulted in the deployment of XMRig cryptocurrency miners on compromised Node-RED systems.

The findings reinforce the security risks associated with granting shell access to AI agents and highlight the need for strict controls around agent capabilities.

API Keys and Cloud Credentials Become High-Value Targets

Beyond gaining execution access, attackers actively pursued credentials stored within AI infrastructure. In LiteLLM environments, researchers observed attempts to extract proxy master keys directly from the memory of running Python processes, allowing attackers to retrieve secrets that might not be stored on disk.

Threat actors also examined configuration locations and enumerated backend AI models before selecting targets for API key theft, unauthorized resource consumption, or broader cloud compromise.

This behavior effectively turns AI gateways into centralized credential repositories. A single exposed proxy may provide access to multiple AI providers, while associated cloud permissions and MCP-connected services can significantly amplify the impact of a breach.

To avoid detection, attackers adopted naming conventions and directory structures that blended into typical AI development environments. In one Langflow incident, a cryptocurrency miner was hidden within a concealed .claude directory and disguised under the name "unicorn," making it appear to be a legitimate development component.

Defensive Recommendations

Organizations should treat AI infrastructure as a critical component of their attack surface and apply the same security principles used to protect traditional enterprise services.

Key recommendations include:

• Maintain a complete inventory of AI services and assign ownership.
• Require strong authentication before exposing AI services to the internet.
• Limit permissions granted to AI agents, proxies, and connected tools.
• Segregate MCP services and connected resources into controlled security zones.
• Apply security patches and updates promptly.
• Restrict unnecessary outbound network access.
• Monitor for unusual behavior, such as AI services spawning shells, downloading external payloads, or launching unexpected processes.
• Rotate exposed credentials immediately and investigate suspicious activity.
• Review all connected tools, secrets, network paths, and approval workflows associated with AI deployments.

As AI systems become increasingly integrated into enterprise environments, attackers are adapting their tactics accordingly. Organizations must recognize that AI gateways, agents, and orchestration platforms can serve as powerful attack vectors if not secured with the same rigor as traditional cloud and infrastructure assets.