Attackers Exploit MCP RCE, Blind Prompt Injection and Memory Credential Theft Against AI Infrastructure

Attackers are increasingly treating AI infrastructure as a high-value cloud entry point, exploiting exposed Model Context Protocol (MCP) services, agent frameworks, and AI gateways to execute code, validate prompt injection, deploy cryptominers, and steal credentials from process memory.

The campaigns show that attackers are no longer using only generic web-server tradecraft; they are tailoring reconnaissance, credential theft and payload camouflage to the internals of deployed AI stacks.

The risk is amplified by the rapid adoption of self-hosted and managed AI services in cloud environments.

Wiz’s 2026 cloud-AI report found that 90% of cloud environments run self-hosted AI software, while 81% use managed AI services and 63% host their own models.

AI proxies and agents often sit between users, models, cloud identities, MCP tools and internal APIs, making one exposed component a potentially valuable route to credentials and lateral movement.

The most direct activity targeted LiteLLM’s MCP functionality.

Researchers observed attackers abusing an authentication-bypass flaw, tracked as CVE-2026-59822, in which a fabricated Authorization header can trigger a faulty OAuth2 fallback and allow requests to reach MCP tooling without a valid LiteLLM key.

Threat actors also exploited CVE-2026-42271, a command-injection vulnerability in LiteLLM MCP server preview endpoints.

The affected endpoints accept an MCP configuration that includes a command field and can spawn that command during connection testing.

The vulnerability affects LiteLLM versions 1.74.2 through 1.83.6 and was fixed in version 1.83.7.labs.

In the honeypot activity, attackers supplied a malicious stdio-based MCP configuration that downloaded and launched a cryptominer, while returning a syntactically valid MCP handshake to make the connection test appear legitimate.

The observed payload used a temporary hidden directory, launched the miner in a detached process and removed the staging directory afterward, reducing disk-level forensic evidence.

CVE-2026-42271 was added to CISA’s Known Exploited Vulnerabilities catalog in June 2026.

Security researchers have also documented how the flaw can be combined with the Starlette host-header validation bypass, CVE-2026-48710, to turn an authenticated code-execution bug into an unauthenticated compromise path.

A second attack pattern involved blind prompt injection against agent platforms including LangChain, Flowise, OpenWebUI and Node-RED.

Rather than requiring visible command output, the attackers attempted to coerce an agent with shell access into making DNS requests to attacker-controlled out-of-band application security testing, or OAST, domains.

The callback provides proof that the injected instruction reached an execution-capable tool without exposing output through the application interface.

Wiz Threat Research said it observed sustained activity over 90 days of honeypot telemetry covering AI and machine-learning services, including LiteLLM, Flowise, LangChain, Langflow, ChromaDB, and Ollama.

Attackers then retrieved follow-on commands from external services, often using Base64 encoding to reduce the chance that simple prompt filters or application logs would expose the final payload.

MCP RCE Exploitation

Successful sessions ended with XMRig cryptocurrency miners staged in AI-adjacent directories, including locations designed to blend into Node.js and agent-framework environments.

The activity demonstrates why prompt injection is not merely a model-behavior problem: it becomes an infrastructure-compromise issue once an agent can invoke shells, network tools, code runners or privileged connectors.

The third pattern was AI-native post-exploitation. Instead of limiting collection to SSH keys, cloud metadata or common configuration files, attackers interrogated LiteLLM’s loaded Python module state to recover proxy master keys.

This technique is particularly dangerous for AI gateways because they may centralize API keys for OpenAI, Anthropic, Azure and Google Gemini, alongside cloud IAM permissions and access to MCP-connected internal services.

An attacker who compromises the proxy can determine which back-end models are reachable, steal credentials, consume inference quotas in LLMjacking operations or pivot into connected enterprise systems.

Researchers also observed framework-aware camouflage. On a Langflow target, a miner was reportedly staged under /app/data/.claude/ and renamed unicorn, a choice intended to resemble artifacts associated with Claude Code and evade casual administrative review.

Organizations should inventory every internet-accessible AI component and assign clear ownership, monitoring and patching responsibility.

Exposed AI services should require authentication by default, while LiteLLM MCP routes and preview endpoints should be disabled or restricted if not essential.

Teams should immediately upgrade LiteLLM beyond the affected releases, rotate provider and proxy credentials that may have been exposed, and place MCP services behind authenticated, network-restricted reverse proxies.

Runtime detection is equally important. Alerts for an AI server spawning shells, Python one-liners, download utilities, Base64 decoders, archive extractors or unexpected outbound DNS traffic can expose both MCP exploitation and agent-driven prompt injection.

AI infrastructure should now be secured as credential-dense production infrastructure not experimental tooling.

IOCs

Indicator	Type	Description
185.62.1[.]8	IP	Malware download server (LiteLLM/MCP campaign)
185.84.98[.]85	IP	Cryptominer C2
pool.hashvault[.]pro	Domain	Monero mining pool (multiple campaigns)
crazyeltonproxy[.]top	Domain	Monero mining proxy (LangChain + Node-RED)
94.26.106[.]29	IP	Langflow binary staging

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

★ Which Security Tools Should You Cut? Score Them on One Page – Download the Inherited Security Stack Guide