Security researchers have uncovered a wave of attacks targeting AI infrastructure—particularly model gateways, agent tools, and AI proxies—using remote code execution (RCE), prompt injection, and API key theft. While attackers probe widely used tools, the exposure of minor vulnerabilities is enabling major breaches.
Over the past three months, suspicious activity has been observed in services that either route traffic to AI models or enable AI agents to interact with external tools. Attackers have combined poorly secured server setups with dangerous instructions, allowing them to execute commands and access sensitive credentials. These findings come from honeypots deployed to mimic real AI systems, revealing how exposed connectors are being weaponized.
Weak Gateways, Big Risks: RCE in AI Components
One of the most targeted components has been the Model Context Protocol (MCP), which lets agents interface with systems like internal APIs, code repositories, and databases. Attackers exploited vulnerabilities in tools like LiteLLM and frameworks that support MCP gateways, including authentication bypasses and command injections. In particular, flaws known as CVE-2026-59822 and CVE-2026-42271 were used—one allowed trivial bearer tokens; the other enabled command execution via misconfigured test endpoints. Coupling these with a host-header bypass vulnerability (CVE-2026-48710) gave attackers unauthenticated remote code execution.
These breaches have been linked to known ransomware groups such as Qilin. Essentially, any agent gateway that runs configured commands to verify connections—even for seemingly routine operations—can become a critical vulnerability if left open.
Prompt Injection and API Key Theft: A Dual Threat
Separate attacks have involved blind prompt injection, where untrusted input causes an agent with shell access to execute commands without returning output to the user. Such tactics evaded standard detection by downloading payloads from services like Pastebin and embedding instructions in encoded form. On affected systems—including Node-RED—successful attacks deployed Monero mining software under the radar.
Beyond executing unauthorized code, attackers sought API keys and master credentials. On platforms like LiteLLM, malicious actors accessed in-memory Python processes to extract keys not stored on disk. This enabled gateway tools to serve as credential stores, with agents moving laterally to exploit multiple backends. In one case, malware was hidden inside directories named to blend in with expected development tools to avoid suspicion.
For mitigation, organizations are urged to inventory AI services, impose strict ownership, and authenticate exposed endpoints. Gateways must be treated as critical zones—permissions, network paths, and cloud roles attached to them reviewed carefully. Monitoring is key: alert on unexpected process launches, shell spawning, and unusual downloads. Rotate credentials often, and ensure logs are closely examined for suspicious behaviors.
Indicators of compromise include external servers tied to malware downloads, cryptominer control nodes, renamed directories disguised as developer tools, and mining pools linked to Monero. Specific paths such as /tmp/.dbus-cache/ among others have appeared in live attacks.
The attacks striking now reinforce one major lesson: securing AI infrastructure means more than locking down models. Gateways and agent frameworks represent new perimeter layers that attackers are probing aggressively. Even small misconfigurations can cascade into systemwide risks.
Ultimately, defenders must adapt: AI infrastructure inherits all the attack surfaces of traditional cloud services—and more. What’s crucial isn’t just building smarter models, but deploying them with zero-trust principles, robust permissions, and constant observability. Waiting until something goes wrong is no longer an option.
