What happened
Wiz Threat Research published findings from a 90-day honeypot campaign targeting AI/ML services (LiteLLM, Flowise, LangChain, Langflow, ChromaDB, Ollama), documented in coverage published in the Sept 2-3, 2026 window, showing active exploitation of the LiteLLM MCP auth-bypass KEV entry, chained RCE via LiteLLM MCP connection-test command execution plus the Starlette Host-header smuggling bug, and blind prompt-injection campaigns using DNS-based out-of-band confirmation against multiple agent frameworks.
Why it matters
This moves AI-infrastructure targeting from theoretical/PoC into confirmed, sustained real-world attacker interest, showing that generic web-attack techniques (auth bypass, OOB command confirmation, credential harvesting) are now being specifically adapted to the internals of AI gateways and agent frameworks, with attackers deliberately hunting for LiteLLM master keys and provider backend enumeration rather than generic server compromise.
Attack vector
Attackers combine authentication-bypass exploitation of MCP gateways (LiteLLM CVE-2026-59822/CVE-2026-42271 chained with Starlette CVE-2026-48710) with blind/out-of-band prompt injection against agent frameworks (LangChain, Flowise, OpenWebUI, Node-RED) that instructs agents to execute OS commands and exfiltrate results via DNS lookups rather than HTTP responses, followed by AI-native post-exploitation that specifically searches running LiteLLM process memory for master keys and enumerates connected model-provider backends.
Affected systems
LiteLLM (CVE-2026-59822, CVE-2026-42271), Starlette (CVE-2026-48710), LangChain, Flowise, OpenWebUI, Node-RED, ChromaDB, Ollama
Mitigation
Do not expose AI infrastructure (LiteLLM, MCP gateways, vector DBs, inference servers) directly to the internet; enforce authentication by default; segregate and scope model-provider API keys and cloud IAM per service; monitor for unexpected outbound DNS/HTTP from AI infrastructure hosts; patch to LiteLLM 1.84.0+/1.83.7+ and current Starlette.