AI Honeypots Reveal Attacks That Chat Logs Can Miss

AI security teams have a concrete detection lesson for September 9: look beyond the conversation. In research published August 27, Wiz described 90 days of honeypot activity targeting AI infrastructure. Its findings span MCP-related remote code execution, activity attributed to blind prompt injection, and reconnaissance tailored to AI services. Cloud Security Alliance examined the report on September 1. Together, they make runtime visibility a timely priority for teams operating AI gateways and agent frameworks.

Wiz observed malicious MCP configuration tests that launched cryptomining software while returning a valid protocol handshake. A successful connection test therefore did not establish that the underlying process was safe. The report also describes attackers querying LiteLLM-specific Python state for credentials and using AI-tool-looking directories to camouflage malware. These are observations from honeypots, not a measurement of how many production organizations were compromised.

The blind prompt injection evidence needs careful reading. Wiz describes shell execution and DNS callbacks associated with agent frameworks, but explicitly says it did not capture the natural-language prompt in those cases. Its example prompt is a reconstruction. Defenders can use the reported process and network behavior to inform detection without treating that example as a recovered attack transcript.

Cloud Security Alliance recommends restricting MCP configuration and test endpoints to administrative access, removing public reachability, narrowing permissions, and controlling outbound traffic. Its analysis also highlights credential concentration in AI gateways: a compromise can put downstream access at risk. For operators, this means an incident review should cover the gateway’s connected services and credentials, as well as the initial host. Apply credential rotation according to the exposure established during investigation.

The HackWednesday action is to test visibility on one representative AI service this week. In an isolated, authorized environment, verify that an unexpected child process and an unapproved outbound connection produce attributable alerts. Record the service owner, workload identity, destination, and response path. Pair those results with an inventory of public endpoints and privileged tool access. The useful outcome is evidence that suspicious execution will be detected even when an application response looks ordinary.