AI · 46 days ago

Wiz Flags AI Gateways as a New Attack Plane

Wiz said 90 days of honeypot telemetry showed sustained attacks against AI infrastructure, with tooling built for LiteLLM, MCP servers, and agent frameworks rather than generic web apps. The findings cover three patterns: remote code execution on exposed MCP servers, blind prompt injection against AI agents, and post-exploitation that targets memory and stored credentials.

In plain terms, attackers are not trying to “break the model”; they are abusing the systems around it. A proxy like LiteLLM can hold keys for multiple model providers and cloud permissions, and agent frameworks are meant to act on external input, so a successful compromise can hand an attacker downstream API keys, internal tool access, and other services the AI stack is already allowed to reach.

For teams running LiteLLM, Flowise, LangChain, Langflow, ChromaDB, Ollama, MCP servers, or Starlette-based AI services, the lasting issue is the control plane itself: a front-end AI service can become a credential store and a bridge into internal systems. Wiz’s reporting suggests standard app containment may miss what the AI layer can touch after it is trusted to route, read, and act.

CVE-2026-42271

NVD KEV

Known exploited · CISA KEV

CVSS 8.8 HIGH: liteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. EPSS 93% (100th percentile).

CISA federal remediation date Jun 22 · date passed

CVE-2026-59822

NVD KEV

Known exploited · CISA KEV

EPSS 0.8% (56th percentile).

CISA federal remediation date Sep 16

CVE-2026-48710

NVD KEV

Known exploited · CISA KEV

CVSS 6.5 MEDIUM: starlette is a lightweight ASGI framework/toolkit.

CISA federal remediation date Sep 16

Timeline

Sep 16 CISA federal deadline for CVE-2026-59822
Sep 2 CVE-2026-59822 added to CISA KEV
Aug 27 Reported by Wiz Research
Jun 22 CISA federal deadline for CVE-2026-42271 passed
Jun 8 CVE-2026-42271 added to CISA KEV

Sources

1 source covering this story

Wiz Research Aug 27
Attacks on AI Infrastructure: 90-Day Honeypot Telemetry | Wiz Blog
Wiz Threat Research analyzed 90 days of attacks on AI infrastructure, uncovering MCP exploits, blind prompt injection, and memory credential theft.

Entities

CVE-2026-42271
CVE-2026-48710
CVE-2026-59822

Part of the PlainSec briefing for 2026-08-28

Editions

AI · 46 days agoWiz Flags AI Gateways as a New Attack PlaneWiz said 90 days of honeypot telemetry showed sustained attacks against AI infrastructure, with tooling built for LiteLLM, MCP servers, and agent frameworks rather than generic web apps. The findings cover three patterns: remote code execution on exposed MCP servers, blind prompt injection against AI agents, and post-exploitation that targets memory and stored credentials.In plain terms, attackers are not trying to “break the model”; they are abusing the systems around it. A proxy like LiteLLM can hold keys for multiple model providers and cloud permissions, and agent frameworks are meant to act on external input, so a successful compromise can hand an attacker downstream API keys, internal tool access, and other services the AI stack is already allowed to reach.For teams running LiteLLM, Flowise, LangChain, Langflow, ChromaDB, Ollama, MCP servers, or Starlette-based AI services, the lasting issue is the control plane itself: a front-end AI service can become a credential store and a bridge into internal systems. Wiz’s reporting suggests standard app containment may miss what the AI layer can touch after it is trusted to route, read, and act.