OTX Threat: Attacks on AI Infrastructure: 90-Day Honeypot Telemetry

Wiz Threat Research deployed honeypots across AI and ML services including LiteLLM, Flowise, LangChain, Langflow, ChromaDB, and Ollama, observing sustained attack activity over 90 days. Three distinct attack patterns emerged: exploitation of Internet-facing MCP servers for remote code execution through authentication bypass and command injection vulnerabilities; blind prompt injection attacks agai CVEs: CVE-2026-42271, CVE-2026-48710, CVE-2026-59822