Hackers exploit AI gateways to steal API keys and mine Monero, Wiz finds

Wiz Threat Research found hackers exploiting exposed AI infrastructure to steal model-provider API keys and deploy Monero cryptomining software, according to a 90-day honeypot study published Aug. 27, 2026.

The honeypots included platforms such as LiteLLM, Flowise, LangChain, Langflow, ChromaDB and Ollama. During the monitoring period, Wiz observed attackers adapting their techniques to the specific architecture and components of the AI services they encountered.

The findings point to an expanding cloud attack surface in which AI systems can become attractive targets because they frequently handle sensitive credentials, communicate with internal tools, process untrusted information and maintain connections to cloud services.

A successful compromise of an AI proxy could potentially expose API keys belonging to major model providers, including OpenAI, Anthropic, Azure and Gemini, while simultaneously giving attackers an opportunity to conduct cryptojacking operations.

Cryptojacking campaigns target exposed AI infrastructure

Wiz identified several attack patterns during its investigation, beginning with attacks against exposed Model Context Protocol (MCP) servers.

MCP enables AI agents to interact with external systems such as databases, code repositories, internal application programming interfaces and collaboration platforms. That connectivity can make an improperly secured MCP implementation a particularly valuable entry point for attackers.

Researchers observed exploitation attempts targeting MCP components in LiteLLM. One vulnerability, identified as CVE-2026-59822, involved an authentication bypass linked to incorrect OAuth2 header handling.

According to Wiz, attackers used a minimal Bearer token to probe model-enumeration endpoints. The activity demonstrated how threat actors were testing AI-specific interfaces rather than simply applying conventional attacks against generic cloud infrastructure.

A second vulnerability, CVE-2026-42271, affected LiteLLM MCP server test endpoints. The flaw could allow malicious commands to be injected into a server configuration and ultimately cause the application to execute a Python payload.

That payload was used to download a cryptominer, launch it in the background and remove the staging directory afterward.

The approach is particularly relevant to cryptojacking because deleting the files used to install the miner can reduce the amount of evidence left on the compromised system. Wiz said the miner could continue operating after the staging files had been removed.

The researchers also noted that CVE-2026-42271 could potentially be combined with CVE-2026-48710, described in the report as a Starlette host-header validation bypass, to achieve unauthenticated remote code execution.

Blind prompt injection opens another cryptojacking route

Wiz identified a second attack pattern involving blind prompt injection against AI agent frameworks.

Attackers sent malicious instructions to environments using platforms including LangChain, Flowise, OpenWebUI and Node-RED. The objective was to persuade AI agents to invoke shell or command-execution functionality.

Rather than waiting for the AI system to return the output of an executed command, attackers used DNS callbacks to domains under their control. These callbacks allowed them to determine whether their malicious prompt had successfully triggered the intended action.

Once execution was confirmed, the attackers downloaded additional payloads from external hosting services and deployed XMRig, a widely used Monero mining program.

In one observed case, researchers found a miner located at /usr/src/node-red/xmrig, a placement that could help it appear consistent with a Node.js environment.

The sequence illustrates how cryptojacking attacks can evolve when they are directed at AI systems. Instead of relying solely on conventional vulnerabilities, attackers can attempt to manipulate the systems’ own agentic capabilities to reach command-execution functions.

The activity also demonstrates why prompt injection has security implications beyond manipulated responses or unwanted model behaviour. When AI agents are connected to tools capable of executing commands, a successful injection could potentially become a pathway to broader system compromise.

Attackers hunt AI credentials after compromise

The third pattern identified by Wiz involved post-exploitation activity specifically tailored to AI environments.

Rather than limiting their searches to traditional targets such as SSH keys or cloud credential files, attackers looked for information unique to AI deployments. This included model-provider API keys, LiteLLM master keys, framework configuration files and accessible backend models.

On compromised LiteLLM installations, attackers queried Python module memory in an attempt to retrieve the master key being used by the running application.

Researchers also identified searches for configuration files in locations including /app/litellm_config.yaml, /etc/litellm/.env and ~/.litellm/config.yaml.

The behaviour highlights another potential consequence of cryptojacking campaigns against AI infrastructure: the cryptocurrency miner may be only one component of a broader intrusion.

An exposed AI service can contain credentials that provide access to external model providers or connected services. If those credentials are stolen, attackers could potentially abuse them independently of the mining operation.

Wiz’s findings therefore suggest that defenders should consider AI infrastructure as a distinct security environment rather than treating it simply as another cloud workload.

The researchers’ honeypot observations showed attackers examining the internals of individual AI applications and adjusting their post-exploitation behaviour accordingly. That platform-specific approach can make traditional security assumptions less reliable.

Cryptojacking exposes growing risks around AI agents

The research comes as organisations increasingly deploy AI systems with access to internal applications, data and external services. The same integrations that make AI agents useful can also expand the consequences of a successful compromise.

For security teams, cryptojacking is one visible outcome of that risk because unauthorized mining consumes computing resources and can affect system performance. But the exposure of API keys and other credentials could create additional security and financial consequences.

Wiz identified infrastructure associated with the observed activity, including the defanged IP address 185.62.1[.]8, which researchers linked to a malware download server used in the LiteLLM/MCP cryptomining campaign. Another address, 185.84.98[.]85, was associated with cryptominer command-and-control infrastructure.

The indicators provide security teams with information that can be used to investigate potentially compromised systems in controlled threat-intelligence or security-monitoring environments.

The broader concern is that cryptojacking operators are adapting their methods to the architecture of emerging technologies. AI servers and agent frameworks can combine valuable credentials, powerful compute resources and connections to other systems, creating several opportunities for attackers following an initial compromise.

Wiz’s research does not suggest that AI platforms are inherently insecure. Rather, it demonstrates how exposed or poorly secured deployments can become attractive targets for threat actors looking to exploit both conventional vulnerabilities and AI-specific functionality.