OpenWebUI

Attackers hid a cryptominer inside a LiteLLM MCP config test that reported success

Ninety days of Wiz honeypot telemetry shows tooling written for LiteLLM's internals, including a config test endpoint that spawns whatever command it is handed and a miner whose output comes home inside the MCP protocol.