Wiz said 90 days of honeypot telemetry showed sustained attacks against AI infrastructure, with tooling built for LiteLLM, MCP servers, and agent frameworks rather than generic web apps. The findings cover three patterns: remote code execution on exposed MCP servers, blind prompt injection against AI agents, and post-exploitation that targets memory and stored credentials.
In plain terms, attackers are not trying to “break the model”; they are abusing the systems around it. A proxy like LiteLLM can hold keys for multiple model providers and cloud permissions, and agent frameworks are meant to act on external input, so a successful compromise can hand an attacker downstream API keys, internal tool access, and other services the AI stack is already allowed to reach.
For teams running LiteLLM, Flowise, LangChain, Langflow, ChromaDB, Ollama, MCP servers, or Starlette-based AI services, the lasting issue is the control plane itself: a front-end AI service can become a credential store and a bridge into internal systems. Wiz’s reporting suggests standard app containment may miss what the AI layer can touch after it is trusted to route, read, and act.