Inside 90 days of attacks on AI infrastructure
wiz.io | research | #ai-security | #cloud | #rce | #threat-intelligence | #mcp | #prompt-injection | #llm-security | #security-research | #threat-research | #litellm | #honeypot | #wiz
Summary
Wiz honeypots logged 90 days of attacks on AI infrastructure — LiteLLM, Flowise, LangChain, ChromaDB, Ollama — via MCP server RCE, blind prompt injection, and AI-native post-exploitation tooling.
Why it matters
This research provides real-world threat telemetry on how attackers target modern AI deployments and MCP interfaces.
- Published
- Collected
--- id: 6760 title: "Inside 90 days of attacks on AI infrastructure" source_domain: wiz.io source_url: "https://www.wiz.io/blog/ai-infrastructure-honeypot" published_at: "2026-08-27T16:33:16Z" tags: ["ai-security", "cloud", "rce", "threat-intelligence", "mcp", "prompt-injection", "llm-security", "security-research", "threat-research", "litellm", "honeypot", "wiz"] phying_url: "https://phying.com/item/6760" lang: en --- # Inside 90 days of attacks on AI infrastructure ## Summary Wiz honeypots logged 90 days of attacks on AI infrastructure — LiteLLM, Flowise, LangChain, ChromaDB, Ollama — via MCP server RCE, blind prompt injection, and AI-native post-exploitation tooling. ## Why it matters This research provides real-world threat telemetry on how attackers target modern AI deployments and MCP interfaces. ## Intelligence Metadata - **Sources:** wiz.io - **Published:** 2026-08-27T16:33:16Z - **Original:** https://www.wiz.io/blog/ai-infrastructure-honeypot - **Phying News:** https://phying.com/item/6760