Lumen's Black Lotus Labs says the PoeLLM cryptomining botnet has compromised more than 2,100 servers, many running exposed LiteLLM or Ollama. Each host it takes then mines and scans for the next, so an AI server left open to the internet is attack surface to lock down.
Perspective Coverage
6 publishers
- Builder
- Builder 34%
- Operator
- Operator 59%
- Investor
- Investor 7%
Reality
- Evidence70
- Adoption50
- Hype gap+5
- Incentives
- Insufficient
- Confidence70
SonicWall's CVSS 10.0 SSRF chains into command execution on remote access appliances, and JFrog Artifactory hands unauthenticated attackers admin under default configuration. Reverse shells and miners are already landing.
Perspective Coverage
4 publishers
- Builder
- Builder 14%
- Operator
- Operator 72%
- Investor
- Investor 14%
Reality
- Evidence70
- Adoption
- Insufficient
- Hype gap+10
- Incentives35
- Confidence68
buildOne report1 publisher LiteLLM's MCP test endpoints let any valid proxy key run arbitrary commands on the gateway, rated CVSS 8.8. CISA added the flaw to its Known Exploited Vulnerabilities catalog on June 8, 2026, confirming exploitation in the wild.
Reality
- Evidence50
- Adoption
- Insufficient
- Hype gap+10
- Incentives
- Insufficient
- Confidence50
buildOne report1 publisher CVE-2026-48710 is in CISA's Known Exploited Vulnerabilities catalog, scored 6.5 by Starlette's maintainers and 10.0 by Horizon3.ai once chained with a LiteLLM command injection. Version 1.0.1 is the fix.
Reality
- Evidence45
- Adoption55
- Hype gap+12
- Incentives65
- Confidence50
buildOne report1 publisher X41 D-Sec's proof of concept for CVE-2026-48710 is one unauthenticated GET whose Host header carries /public?bar=. Starlette sits underneath LiteLLM, vLLM and MCP servers, so the work starts with a dependency query.
Reality
- Evidence56
- Adoption
- Insufficient
- Hype gap+18
- Incentives55
- Confidence52
buildOne report1 publisher Microsoft Security Research says intruders who reached exposed LiteLLM, RAGFlow and Kestra deployments went for provider keys and database URLs first. It can name a confident initial vector in only one of the three cases.
Reality
- Evidence45
- Adoption30
- Hype gap+10
- Incentives55
- Confidence42
Ninety days of Wiz honeypot telemetry shows tooling written for LiteLLM's internals, including a config test endpoint that spawns whatever command it is handed and a miner whose output comes home inside the MCP protocol.
Reality
- Evidence62
- Adoption66
- Hype gap+12
- Incentives72
- Confidence55
Three Microsoft investigations into AI middleware ended in stolen keys, persistence and compute abuse. The remediation list is ordinary infrastructure hygiene, applied to plumbing nobody inventoried.
Reality
- Evidence66
- Adoption42
- Hype gap+12
- Incentives68
- Confidence52