Off Guard: Breaking LiteLLM from authentication bypass to cloud compromise
How default keys, unauthenticated MCP sessions, and custom code guardrails expose cloud AI infrastructure to root-level remote code execution and IAM theft.
Summary from Wiz Blog.
Explained
The technology and terms in this story. Learn more
- WeaknessAuthentication bypassA flaw that lets someone in without valid credentials.
- ProtocolMCP · Model Context ProtocolA standard way to connect AI models to tools and data sources.
- AttackRemote code execution · RCEA flaw that lets an attacker run their own code on someone else's machine over the network.