Inside 90 days of attacks on AI infrastructure

Researchers at Wiz found widespread attacks on AI infrastructure services like LiteLLM and Flowise over 90 days, exploiting three main patterns: remote code execution (running unauthorized commands on systems) through exposed MCP servers (tools that let AI agents access external services like databases), prompt injection (tricking AI agents by hiding malicious instructions in their inputs), and post-exploitation techniques targeting AI-specific systems. AI infrastructure is attractive to attackers because it often concentrates many API credentials (keys for services like OpenAI and Azure) in one place, and AI agents are designed to execute instructions from external inputs, making them vulnerable to compromise.