CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

Wiz Cloud Threat Highlights: H1 2026

report · report:wiz-cloud-threat-highlights-h1-2026 single-source

Wiz Research's semi-annual cloud and AI threat report covering January to June 2026, published 2026-08-06. Names LiteLLM (present in over a third of the cloud environments Wiz monitors) as having four separate security events in six months, records critical unauthenticated flaws in Dify, Langflow, n8n and Ollama, reports unauthenticated Model Context Protocol endpoints across hundreds of environments each holding backend credentials, and profiles the cloud extortion actor JINX-0163.

Coverage
1
first 2026-08-08 → last 2026-08-08
Latest activity
2026-08-08
The AI toolchain became a cloud attack surface with its own recurring vulnerability cadence, and the…
Peak priority
notable
1 notable
Targets
technology
sectors: technology, public-sector, finance
Sources cited
1
1 hosts

Action items (1)

Do-now tasks recorded on the entries about Wiz Cloud Threat Highlights: H1 2026, newest first. Check the date before acting on an older one.

  • Inventory Model Context Protocol endpoints in your cloud estate and confirm each one requires authentication, Wiz found unauthenticated MCP endpoints across hundreds of environments, and each is a pre-authenticated proxy already holding the backend credentials it bridges.
    2026-08-08The AI toolchain became a cloud attack surface with…

Defender insights

What each entry about Wiz Cloud Threat Highlights: H1 2026 tells a defender to do, newest first.

2026-08-08NOTABLEThe AI toolchain became a cloud attack surface with its own recurring vulnerability cadence, and the credentials it holds are non-human

Relationships explore in graph

Typed, source-stated connections from the entity registry; each edge cites the entry whose reporting establishes it.

documents

Story timeline

  1. 2026-08-08Wiz Cloud Threat Highlights H1 2026: LiteLLM had four separate security events in six months, unauthenticated MCP endpoints turned up across hundreds of environments, and a new extortion actor goes after service accounts rather than people
    researchThe AI toolchain became a cloud attack surface with its own recurring vulnerability cadence, and the credentials it holds are non-human

Hunting pivots

Affected products
DifyLangflowLiteLLMOllaman8n
Tags
ai-abusecloudidentityorganized-crimesupply-chain
ATT&CK techniques (4 across 5 tactics)

4 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.0 · compare on the matrix · Navigator layer (JSON)

  • Initial AccessValid Accounts: Cloud Accounts · Exploit Public-Facing Application · Supply Chain Compromise: Compromise Software Dependencies and Development Tools
  • PersistenceValid Accounts: Cloud Accounts
  • Privilege EscalationValid Accounts: Cloud Accounts
  • StealthValid Accounts: Cloud Accounts
  • Credential AccessUnsecured Credentials

Initial Access TA0001

T1078.004Valid Accounts: Cloud Accounts×1

Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. Cloud Accounts can exist solely in the cloud; alternatively, they may be hybrid-joined between on-premises systems and the cloud through syncing or federation with other identity sources such as Windows Active Directory.

Evidence: 2026-08-08/wiz-cloud-threat-highlights-h1-2026-ai-toolchain-exposure · ATT&CK page ↗

T1190Exploit Public-Facing Application×1

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-08-08/wiz-cloud-threat-highlights-h1-2026-ai-toolchain-exposure · ATT&CK page ↗

T1195.001Supply Chain Compromise: Compromise Software Dependencies and Development Tools×1

Adversaries may manipulate software dependencies and development tools prior to receipt by a final consumer for the purpose of data or system compromise. Applications often depend on external software to function properly. Popular open source projects that are used as dependencies in many applications, such as pip and NPM packages, may be targeted as a means to add malicious code to users of the dependency. This may also include abandoned packages, which in some cases could be re-registered by threat actors after being removed by adversaries. Adversaries may also employ "typosquatting" or name-confusion by choosing names similar to existing popular libraries or packages in order to deceive a user.

Evidence: 2026-08-08/wiz-cloud-threat-highlights-h1-2026-ai-toolchain-exposure · ATT&CK page ↗

Persistence TA0003

T1078.004Valid Accounts: Cloud Accounts×1

Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. Cloud Accounts can exist solely in the cloud; alternatively, they may be hybrid-joined between on-premises systems and the cloud through syncing or federation with other identity sources such as Windows Active Directory.

Evidence: 2026-08-08/wiz-cloud-threat-highlights-h1-2026-ai-toolchain-exposure · ATT&CK page ↗

Privilege Escalation TA0004

T1078.004Valid Accounts: Cloud Accounts×1

Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. Cloud Accounts can exist solely in the cloud; alternatively, they may be hybrid-joined between on-premises systems and the cloud through syncing or federation with other identity sources such as Windows Active Directory.

Evidence: 2026-08-08/wiz-cloud-threat-highlights-h1-2026-ai-toolchain-exposure · ATT&CK page ↗

Stealth TA0005

T1078.004Valid Accounts: Cloud Accounts×1

Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. Cloud Accounts can exist solely in the cloud; alternatively, they may be hybrid-joined between on-premises systems and the cloud through syncing or federation with other identity sources such as Windows Active Directory.

Evidence: 2026-08-08/wiz-cloud-threat-highlights-h1-2026-ai-toolchain-exposure · ATT&CK page ↗

Credential Access TA0006

T1552Unsecured Credentials×1

Adversaries may search compromised systems to find and obtain insecurely stored credentials. These credentials can be stored and/or misplaced in many locations on a system, including plaintext files (e.g. Shell History), operating system or application-specific repositories (e.g. Credentials in Registry), or other specialized files/artifacts (e.g. Private Keys).

Evidence: 2026-08-08/wiz-cloud-threat-highlights-h1-2026-ai-toolchain-exposure · ATT&CK page ↗

Entries about Wiz Cloud Threat Highlights: H1 2026 (1)

2026-08-08 · view entry permalink →

NOTABLENATOB2

Wiz Cloud Threat Highlights H1 2026: LiteLLM had four separate security events in six months, unauthenticated MCP endpoints turned up across hundreds of environments, and a new extortion actor goes after service accounts rather than people

Wiz Research's semi-annual cloud threat report covers January to June 2026, and its value for this constituency is the named inventory rather than the trend lines: it says concretely which AI infrastructure attracted attacker and researcher attention, and what the resulting exposure looks like in a cloud estate.

The AI toolchain now has its own vulnerability cadence. LiteLLM (an AI gateway Wiz says is present in over a third of the cloud environments it monitors) "had four separate security events in six months: a supply-chain compromise, an SQL injection vulnerability exploited in the wild, a privilege escalation chain and an authentication bypass", while Dify, Langflow, n8n and Ollama "each had critical unauthenticated vulnerabilities of their own" (Wiz Research, 2026-08-06). That list is worth reading as an asset-inventory prompt: these are components teams stand up quickly, often outside the change process that governs the rest of the estate, and three of the five have already reached this pipeline's coverage through separate exploited-vulnerability events.

The exposure finding is sharper than the vulnerability one. On Model Context Protocol servers, Wiz reports: "We found unauthenticated MCP endpoints across hundreds of environments, each one a pre-authenticated proxy holding backend credentials and bridging multiple services" (Wiz Research, 2026-08-06). The reason that shape matters is that an MCP server is not a data store to be broken into; it is a component that already holds the credentials for everything behind it and exists to act on their behalf, so reaching it unauthenticated is not a step toward access, it is the access.

On the actor side, Wiz profiles JINX-0163, a cloud-native extortion group it began tracking in 2026 and that "consistently targets non-human identities - service accounts and IAM roles - rather than end users", in some cases leveraging a single over-privileged identity or an exposed state file to pivot to a full inventory (Wiz Research, 2026-08-06). An extortion group that skips human identity entirely bypasses most of the control stack organisations have spent two years building (phishing-resistant MFA, conditional access, helpdesk verification) none of which applies to a service account.

On supply chain, Wiz records that notable supply-chain attacks "went from making up about 10% of significant incidents in H2 2025 to 25% in H1 2026", with TeamPCP, North Korea and at least three independent operations running campaigns concurrently across npm, PyPI, Composer, VSCode extensions, Jenkins plugins and AUR, several of which had not been targeted this way before (Wiz Research, 2026-08-06). It also notes that malicious packages' shrinking availability window is what makes an install cooldown policy effective (declining to download packages published less than 24 hours ago) which is a specific, cheap control rather than a general recommendation.

We found unauthenticated MCP endpoints across hundreds of environments, each one a pre-authenticated proxy holding backend credentials and bridging multiple services.

They went from making up about 10% of significant incidents in H2 2025 to 25% in H1 2026.

Wiz Research 2026-08-06
annual-report08 Aug 05:22Zsingle-sourceOpen finding →
Sources: Wiz Research

Where this entity is cited

  • Research1

Source distribution

  • wiz.io1 (100%)
All cited sources (1)