Cyber Attackers Exploit AI Infrastructure for API Key Theft and RCE

Cyber attackers are increasingly targeting AI infrastructure, particularly systems like LiteLLM and RAGFlow, to steal API keys and hijack computing resources. Research from Wiz.io indicates that over a 90-day period, attackers have focused on exploiting exposed AI gateways and integrations, using methods such as remote code execution (RCE) and prompt injection. The attacks often begin with internet scans to identify vulnerable endpoints, followed by attempts to exploit weak authentication and insecure configurations. Successful breaches have led to the theft of sensitive credentials, which are then used to deploy cryptominers or further compromise connected cloud services. Small and medium-sized businesses are particularly at risk due to their tendency to use default settings. The sustained interest in these attacks suggests a growing trend in targeting AI systems for broader cloud compromises. Organizations using affected tools are urged to review and secure their deployments immediately.

Key Points: • Attackers are targeting AI infrastructure like LiteLLM and RAGFlow for API key theft. • Methods include remote code execution and prompt injection, exploiting weak authentication. • Small and medium businesses are particularly vulnerable due to default security settings.