AI infrastructure is rapidly becoming a prime target for cyber attackers. Recent research highlights how hackers are exploiting AI systems using remote code execution, prompt injection and API key theft. Over a 90-day period, attackers have shifted focus to exposed AI gateways and agent-tool integrations, turning these services into entry points for deeper cloud compromise.
How Hackers Are Targeting AI Infrastructure
Wiz.io researchers set up honeypots to mimic leading AI infrastructure components, including LiteLLM, MCP servers, LangChain, Flowise, Langflow, OpenWebUI and Node-RED. Their findings reveal that attackers are highly adaptive, developing techniques specifically to exploit the unique characteristics of these AI components.
The main avenues of attack observed include:
- Remote code execution (RCE): Attackers exploit misconfigurations or vulnerabilities to run arbitrary commands on AI servers.
- Prompt injection: Malicious instructions are sent to AI agents, tricking them into revealing sensitive data or executing unintended actions.
- API key theft: Attackers use crafted requests to extract API keys, which are then used to access or abuse cloud resources.
- Cryptomining: Once access is gained, compromised servers are often repurposed to mine cryptocurrencies using stolen computing power.
Many of these attacks begin with simple internet scans to identify publicly exposed AI endpoints. Attackers then probe these systems for weak authentication, default credentials or insecure integrations between agents and external tools.
Vulnerable AI Products and Attack Techniques
The research focused on several popular AI infrastructure tools used by small and medium businesses:
- LiteLLM: Used for routing model traffic, often exposes endpoints that are accessible without authentication.
- MCP servers: Serve as middleware for AI operations, with weakly protected admin panels.
- LangChain, Flowise and Langflow: Enable agent-based workflows and integrations with third-party tools, which can be abused if not securely configured.
- OpenWebUI and Node-RED: Provide user interfaces and automation, frequently deployed with default settings that lack access controls.
Honeypots recorded attackers leveraging two main patterns:
- Exploiting exposed server flaws to gain unauthorised access, then using agent tooling to escalate privileges or move laterally.
- Executing prompt injection attacks that direct AI agents to run system commands, retrieve environment variables or exfiltrate API keys.
In several cases, attackers chained multiple weaknesses: after achieving initial access through a public endpoint, they issued crafted prompts that forced agents to display or transmit sensitive credentials. These credentials were then used to launch cryptomining operations or to further compromise connected cloud services.
Timeline and Evidence of Sustained Attacks
The Wiz.io honeypots collected data over a 90-day period, demonstrating that attacker interest in AI infrastructure is not fleeting. Instead, there is a sustained campaign targeting these emerging technologies.
- Initial scans and probing: Attackers rapidly identified and catalogued exposed AI endpoints within days of deployment.
- Exploit attempts: Within the first weeks, multiple techniques were trialled, including brute-force authentication bypasses, direct API calls and prompt-based attacks.
- Successful intrusion and abuse: In several honeypots, attackers managed to execute arbitrary code and extract API keys, then used these credentials for cryptomining payloads.
The attacks were not isolated incidents but reflected a broad interest in AI systems as a viable entry point for cloud and infrastructure compromise. Attackers tailored their methods according to the specific AI tool in use, showing a degree of sophistication and awareness.
Current Exploitation Status and At-Risk Organisations
The findings indicate that exposed AI infrastructure is under active exploitation. Any organisation running LiteLLM, MCP, LangChain, Flowise, Langflow, OpenWebUI or Node-RED with public-facing endpoints, especially without authentication, is at heightened risk.
Small and medium-sized businesses are particularly vulnerable, as they are more likely to deploy these tools with default settings or weak security controls. Attackers are already scanning the internet for such instances, and successful attacks can quickly escalate to wider cloud compromise or resource abuse.
- Prompt injection attacks and API key theft are ongoing concerns for AI deployments.
- Remote code execution (RCE) is a primary objective, often leading to cryptomining or further credential theft.
- There is no indication that the wave of attacks is subsiding, and new tactics are likely as AI infrastructure adoption grows.
Why This Matters
AI infrastructure is increasingly integrated into core business processes, making any compromise a potential gateway for attackers to access wider cloud environments and sensitive data. The rapid emergence of prompt injection and RCE exploits highlights the need for immediate attention to deployment security.
What Organisations Should Do Now
Organisations using the affected AI tools should take the following targeted actions:
- Remove public exposure for AI endpoints and require strong authentication.
- Harden agent-tool integrations to prevent unauthorised command execution.
- Rotate and securely vault all API keys and credentials connected to AI services.
- Monitor outbound network traffic for signs of cryptomining or credential abuse.
Immediate review and hardening of AI deployments is essential to reduce risk.
Originally reported by cybersecuritynews.com.
