Attackers Exploit LiteLLM and MCP Servers via Blind Prompt Injection and RCE

Threat actors are leveraging blind prompt injection against exposed LiteLLM gateways and Model Context Protocol (MCP) servers to achieve Remote Code Execution (RCE) on host infrastructure. By manipulating AI agents via indirect instructions, attackers bypass standard input filters to execute arbitrary code, facilitating memory credential theft. This attack chain allows for the exfiltration of API keys and cloud secrets, enabling lateral movement into production cloud environments for data exfiltration or the deployment of cryptominers. Immediate remediation requires strict input sanitization, sandboxing of agent tool-connectors, and the implementation of Zero Trust access controls for all AI gateways.

• Threat Landscape: AI Infrastructure as an Entry Point

  • Identification of "glue" software, specifically LiteLLM and MCP, as critical cloud attack vectors.
  • 90-day honeypot monitoring reveals systemic targeting of AI agent orchestration layers.
  • Shift in attacker focus from direct cloud APIs to vulnerable AI-driven tool-connectors.

• Attack Mechanics: Blind Prompt Injection

  • Exploitation of unauthenticated AI gateways to deliver indirect, malicious instructions.
  • Use of "blind" injection techniques where attackers trigger backend actions without needing immediate output.
  • Manipulation of AI agents into invoking dangerous tools or executing unauthorized system-level commands.

• Exploitation Chain: From Injection to RCE

  • Escalation from prompt manipulation to full Remote Code Execution (RCE) on the underlying host.
  • Abuse of framework-level permissions to execute shell commands via AI tool-calling mechanisms.
  • Delivery of malicious payloads to establish initial persistence on the server infrastructure.

• Post-Exploitation: Credential Theft and Pivoting

  • Execution of memory dumps to harvest sensitive API keys and environment variables.
  • Exfiltration of high-privilege cloud provider credentials stored in the orchestration layer's memory.
  • Lateral movement from the AI gateway into core production cloud environments.

• Impact and Objectives: Cloud Resource Abuse

  • Deployment of cryptomining workloads to monetize compromised compute resources.
  • High-severity risk of broad data exfiltration via stolen administrative API keys.
  • Classification of AI frameworks as viable, high-impact entry points for enterprise cloud penetration.

• Mitigation Strategies: Hardening AI Gateways

  • Implementation of strict input sanitization and robust sandboxing for all agent tool-connectors.
  • Adoption of Zero Trust architecture to eliminate unauthenticated external access to AI gateways.
  • Enhanced telemetry and monitoring for anomalous process execution on MCP and LiteLLM hosts.