Wiz Ran a 90-Day Honeypot. Attackers Are Already Planting Cryptominers on MCP Servers.

Wiz ran a 90-day honeypot and caught real attackers chaining three LiteLLM and Starlette CVEs to plant cryptominers and run blind prompt injection.

Wiz Research ran honeypots built to look like real LiteLLM, MCP, and AI agent infrastructure for 90 days, and real attackers found them. The company's August 27, 2026 report, Attacks on AI Infrastructure: 90-Day Honeypot Telemetry, documents live exploitation chaining three vulnerabilities across LiteLLM's MCP Gateway and the Starlette framework underneath it, and it caught attackers doing exactly what security researchers have been warning about for a year: planting cryptominers through fake MCP tool configurations, and running blind prompt injection against agent frameworks confirmed over out-of-band DNS callbacks.

Sources: Attacks on AI Infrastructure: 90-Day Honeypot Telemetry (Wiz Research)

This is not a conference proof-of-concept or a theoretical CVE writeup. A honeypot only records what an attacker actually does after finding a target, without knowing anyone is watching, so the behavior in this report is what MCP infrastructure exposure looks like under production-realistic conditions right now, not what a research team expects someone might eventually try. Wiz, now part of Google Cloud since its $32 billion acquisition closed in March 2026, has spent years publishing large-scale cloud telemetry research, and this dataset applies that same approach to AI infrastructure specifically.

Sources: Google Completes Acquisition of Wiz (Google Cloud Blog)

This argument favors the category we build in, so it is disclosed here directly: we build TLM Forge, a process layer that gates AI-assisted changes behind spec review, independent multi-agent review, and a convergence gate that blocks shipping until critical issues hit zero, and the two defect classes chained in this attack, an authentication fallback that silently trusts an empty token and a test endpoint that spawns an unvalidated subprocess, are exactly the shape of finding that kind of review exists to catch before a change reaches a production server.

The Three Vulnerabilities Attackers Chained Together

Three CVEs make up the attack path Wiz's honeypots recorded, two in LiteLLM's Model Context Protocol Gateway and one in Starlette, the Python web framework LiteLLM and a wide swath of AI agent infrastructure is built on. None of the three is new by itself. All three were disclosed and patched earlier in 2026, but the honeypot data shows attackers still actively working through unpatched deployments months after fixes shipped.

CVE-2026-59822: An Empty Token That Still Gets You In

LiteLLM's MCP Gateway supports OAuth2 passthrough for upstream MCP servers, and its fallback path had a specific flaw: when LiteLLM's own key validation failed, the handler could substitute an empty authentication object instead of rejecting the request outright. In practice that meant almost any Bearer token, GitHub's advisory gives the example of a single character, was enough to open an authenticated MCP session and reach whatever tools and connected services that session exposed. The flaw carries a CVSS v4 score of 8.8 and affects every LiteLLM version before 1.84.0.

Sources: MCP Authentication Bypass via OAuth2 Passthrough Fallback (GitHub Security Advisory GHSA-7488-6r32-c95q)

CVE-2026-42271: A Test Endpoint That Runs Whatever You Send It

Two endpoints meant to preview an MCP server configuration before it gets saved, POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list, accepted a full stdio server configuration in the request body, including the command it should run. When that configuration used the stdio transport, LiteLLM spawned the supplied command as a subprocess on the proxy host, with no command allowlist and no check for an administrator role. The flaw scores CVSS 8.7, affects LiteLLM 1.74.2 through 1.83.6, and CISA added it to its Known Exploited Vulnerabilities catalog on June 8, 2026 after confirming active exploitation.

Sources: CISA Adds Two Known Exploited Vulnerabilities to Catalog, Command Injection in litellm (Snyk)

CVE-2026-48710: The Header Bug That Removes the Need to Log In

On its own, CVE-2026-42271 still needs a valid API key, which limits its reach. CVE-2026-48710, nicknamed BadHost, removes that requirement. Starlette, the ASGI framework underneath LiteLLM and much of the AI agent stack, builds request.url by pasting the raw HTTP Host header directly onto the request path without validating it first. A single malformed character in the Host header can make path-based authentication middleware see one path while the router actually dispatches to a different, protected one. Chained with CVE-2026-42271, that turns an authenticated command injection bug into unauthenticated remote code execution, a combination Horizon3.ai rated CVSS 10.0 when it confirmed the chain on June 1, 2026. Starlette's own base score for the header bug alone is a comparatively modest 6.5, a reminder that a component's isolated CVSS score can understate what it enables once an attacker links it to something else.

Sources: CVE-2026-42271: LiteLLM Unauthenticated RCE (Horizon3.ai), CVE-2026-48710 Authentication Bypass (IONIX Threat Center)

What the Honeypot Recorded Attackers Actually Doing

Planting Cryptominers Through Fake MCP Tool Configurations

The most common payload Wiz recorded was not credential theft, it was cryptomining. Attackers used the command injection path to stage XMRig, an open-source Monero mining binary, inside directories designed to look like ordinary system files: one sample landed at /tmp/.dbus-cache/gmon, another was staged through a compromised Node-RED instance at /usr/src/node-red/xmrig. A compromised MCP server does not need to hold anything valuable to be worth attacking. Spare CPU cycles on someone else's cloud bill are already a return on effort.

Sources: Attacks on AI Infrastructure: 90-Day Honeypot Telemetry (Wiz Research)

Blind Prompt Injection, Confirmed by DNS

The second pattern targeted LangChain, Flowise, and Node-RED deployments Wiz ran specifically as bait, and it solved a problem that has limited prompt injection research: how do you know an injected instruction actually executed inside an agent that gives you no feedback channel back? Wiz's telemetry shows attackers answering that with out-of-band DNS callbacks, delivering base64-encoded commands, in some cases pulled from Pastebin, that once decoded and run by the agent triggered a DNS lookup to an attacker-controlled domain. A hit on that domain is confirmation the injection worked, with no response channel from the agent itself needed, which is exactly what makes the technique blind.

Sources: Attacks on AI Infrastructure: 90-Day Honeypot Telemetry (Wiz Research)

Reading Credentials Straight Out of Process Memory

The third pattern is the one that should worry teams running these frameworks in production. Rather than grep a config file for a secret, attackers queried Python module state directly to pull master keys and provider credentials out of a running process's memory, enumerated framework-specific config paths, fingerprinted which model was in use, and in at least one case against Langflow, camouflaged their foothold inside a .claude/ directory to blend in with an agent's normal working files. That is attacker tradecraft built specifically for how AI agent frameworks hold state at runtime, not a generic Linux post-exploitation script pointed at a new kind of target.

Sources: Attacks on AI Infrastructure: 90-Day Honeypot Telemetry (Wiz Research)

Wiz also published infrastructure indicators from the campaign: malware staging and command hosts at 185.62.1.8, 185.84.98.85, and 94.26.106.29, a mining pool connection to pool.hashvault.pro, and payload staging domains including crazyeltonproxy.top and 1710.rwlp.be. None of those indicators are permanent, attackers rotate infrastructure, but they are a concrete starting point for anyone checking outbound connection logs on an MCP Gateway or agent framework host for signs this specific campaign already reached them.

Sources: Attacks on AI Infrastructure: 90-Day Honeypot Telemetry (Wiz Research)

Why MCP Infrastructure Keeps Showing Up as the Target

MCP servers are an attractive target for a structural reason, not a coincidence. Wiz's own State of AI in the Cloud 2026 report found that 90% of cloud environments now run self-hosted AI models and 81% use managed AI services, which means the honeypot's LiteLLM and MCP gateway setup mirrors what a large share of real organizations already have exposed. And MCP itself is trending toward more of these servers, not fewer: the protocol's own 2026-07-28 specification rewrite moved MCP from a stateful, bidirectional design to a stateless request and response core specifically so servers can scale horizontally, which means more independently running MCP instances, each one a fresh copy of whatever auth and input-handling bugs the underlying code carries.

Sources: State of AI in the Cloud 2026 (Wiz Research)

What a CVE Score Suggests vs What the Honeypot Recorded

What to Actually Do About This

• Patch LiteLLM to 1.84.0 or later and Starlette to 1.0.1 or later before anything else; both CVEs the honeypot exploited have had fixes available since May and June 2026.
• Block the /mcp-rest/test/connection and /mcp-rest/test/tools/list endpoints at the edge if an immediate upgrade is not possible; they are the specific command injection surface.
• Monitor outbound DNS from anywhere an agent framework runs; a lookup to an unfamiliar domain right after an agent processes untrusted input is close to a direct signal of blind prompt injection.
• Rotate API keys and provider credentials for any MCP Gateway or agent framework that has been internet-reachable since before the June 2026 patches, not only the instances you can prove were touched.
• Treat every third-party MCP server the same way, whether or not this specific chain applies to it: verify what it does before you connect it, the way vetting an MCP server before you trust it lays out.

The specific defect that let attackers in, a test endpoint accepting an unvalidated command and spawning it as a subprocess, is exactly the pattern independent review is built to catch: a reviewer whose only job is security flags "this endpoint spawns a subprocess from user input" before a human reviewer skimming a large diff even reaches that line. That is the gap TLM Forge's independent multi-agent review and convergence gate are built to close for the kind of MCP-adjacent code teams are shipping quickly right now: hold the merge until a security-focused pass has actually looked at the exact line that spawns a process, not just the pull request description that says what the endpoint is supposed to do.

The third attack pattern, pulling credentials directly out of a running process's memory, is a reminder of what memory means for a piece of software: whatever state it holds while running, reachable by anyone who gets code execution on the same host. MemX solves an entirely different, personal version of a memory problem, a private, persistent memory layer for an individual's own photos, documents, voice notes, and messages, not a server holding API keys that an attacker's subprocess can query.

Ninety days of honeypot data doesn't prove every deployment is compromised; it proves attackers already found the reachable, unpatched ones and built tooling specific enough to plant a cryptominer, confirm blind prompt injection over DNS, and read credentials out of memory rather than a config file. The CVEs behind this chain have had fixes available since May and June 2026. The honeypot ran through late August. Whatever gap sits between those two dates on a given deployment is the actual attack surface, and it closes with a version bump, not with waiting for a more theoretical warning.