Honeypots Reveal Active Attacks on AI Agent Stacks
Over 90 days, Wiz honeypots saw real attackers hit AI agent infrastructure. They abused Model Control Plane (MCP) servers for remote code execution, ran blind prompt injection to trigger tools, and pinched in-memory credentials. The campaigns dropped cryptominers, probed model endpoints, and treated aggregated API keys as a fast path to cloud abuse.
AI agents are the new junction boxes of the cloud: everything routes through them, and everyone assumes the wiring is sound. Wiz spent 90 days running honeypots for popular components — LiteLLM, Flowise, LangChain, Langflow, ChromaDB and Ollama — and caught attackers doing what attackers do best: look for the weak joints and push.
MCPs as the soft underbelly
Model Control Plane (MCP) servers make convenient choke points. One LiteLLM MCP Gateway bug, CVE-2026-59822, accepted any OAuth2 Bearer token. Any token at all — even a single “x” — unlocked full MCP access, letting intruders probe endpoints such as GET /v1/models. That is the old story of “header present” masquerading as “header valid”.
Honeypots also logged command injection against MCP test endpoints (CVE-2026-42271). Attackers supplied a command that launched Python to fetch and run a cryptominer, then scrubbed staging files while leaving the miner alive in memory. Chained with a Starlette host header bypass (CVE-2026-48710), this became unauthorised remote code execution without credentials. External reporting links this chain to active exploitation by a known ransomware group. The rhythm will be familiar to anyone who remembers how “diagnostic” endpoints kept turning into footholds on early web stacks.
Blind prompt injection, live and noisy
Across LangChain, Flowise, OpenWebUI and Node-RED, attackers pushed blind prompt injection designed to overrule agent instructions and force tool use, usually a shell. Because the agent’s reply might never reach them, they confirmed execution via out-of-band DNS callbacks to OAST domains, with the victim IP packed into the subdomain. Once they saw the ping, they pulled staged payloads from Pastebin, hid commands in base64 to hop naive filters, and dropped Monero miners where they blended in, such as /usr/src/node-red/xmrig. It feels like cross-site scripting meeting server-side request forgery in a lab coat.
Post-exploitation went native to AI tooling. Rather than sweep disks, intruders queried live Python module state to lift LiteLLM master keys straight from memory and walked framework-specific config paths. They poked backend model access with defaults like sk-1234 to decide whether to steal keys, burn inference quotas, or pivot. Camouflage got cute: staging under plausible model folders like .claude and renaming binaries to unicorn.
The pattern is clear: proxies and agents concentrate trust, prompts are untrusted input with teeth, and memory is the new wall safe. The open questions are practical ones: how to reason about agent inputs you never see, how to harden MCPs without breaking convenience, and how to spot keys that never touch disk.
