Not an October event: the report was published 2026-08-27. (Wiz) This is the closest in-the-wild prompt injection case found, labelled Observed (research honeypot): there's no KEV entry, vendor advisory or victim report. It was delivered in requests to exposed agent apps, not by email or documents.
TL;DR: Wiz saw attackers send prompts to exposed LangChain, Flowise, OpenWebUI and Node-RED deployments, aiming to get any agent with a shell tool to run an OS command. They verified execution through DNS callbacks, then deployed XMRig. (Wiz)
Exploitation evidence: Observed (research honeypot)
Wiz Threat Research reports these attacks from its honeypot telemetry. If the agent ran the command, a DNS query fired to an attacker-controlled callback domain (often an OAST provider), signalling execution to the attacker without showing any output. (Wiz)
How the attack works
- Delivery: injected prompts sent to exposed agent endpoints. The attacker's IP is encoded in the callback subdomain, plus a per-session ID. (Wiz)
- Caveat: Wiz didn't capture the natural-language prompt. The example in its post is a reconstruction, "not a captured payload". (Wiz) We don't quote it as real.
- Follow-on: the payload was fetched from Pastebin, and commands arrived base64-encoded to evade prompt filters. Successful sessions ended with XMRig at
/usr/src/node-red/xmrig. (Wiz)
Indicators
| Type | Indicator | Source |
|---|---|---|
| Domain | crazyeltonproxy[.]top (Monero proxy, LangChain + Node-RED) | Wiz |
| Domain | pool.hashvault[.]pro (mining pool) | Wiz |
| Path | /usr/src/node-red/xmrig | Wiz |
What to do
- Require authentication on AI tools, since many ship unauthenticated. Monitor process ancestry (an AI server spawning a shell) and restrict egress. (Wiz)
- MoonSec analysis: remove or gate shell tools on any agent reachable by untrusted input.