AI Gateway Compromises Show New Attack Surface for Enterprises

AI infrastructure platforms are becoming prime targets

AI systems have introduced a new layer of enterprise infrastructure that attackers are actively exploiting. Microsoft security researchers observed three separate compromises targeting AI gateways, retrieval platforms, and orchestration services—systems that concentrate credentials, data access, and execution privileges in ways that make them exceptionally valuable to adversaries.

The intrusions affected a LiteLLM gateway, a RAGFlow deployment, and a Kestra workflow environment. While the entry points differed, the attackers pursued similar objectives: stealing credentials, establishing persistence, and monetizing compute resources through cryptocurrency mining.

Why it matters

These platforms sit between users, applications, data stores, and AI models, giving them access to model-provider API keys, database connection strings, tenant configurations, and execution privileges. A compromise at this layer can expose multiple downstream systems simultaneously. As organizations deploy more AI infrastructure, these control points deserve the same security scrutiny as traditional critical systems like identity providers and database servers.

LiteLLM gateway breach exposed multiple credential layers

In the LiteLLM case, Microsoft assessed with high confidence that attackers exploited the exposed gateway surface, likely through a vulnerability chain involving CVE-2026-42271 and CVE-2026-48710. The first flaw enabled authenticated command execution through MCP stdio test endpoints, while the second bypassed Starlette host-header validation to remove authentication requirements.

Once inside the gateway process, attackers harvested credentials from the runtime environment, targeting model-provider API keys, master keys, database connection strings, and UI credentials. They read /proc/1/environ in containerized deployments where the gateway ran as PID 1, then exfiltrated filtered values using multiple transports including Python urllib, curl, and wget.

Subsequent stages deployed cryptocurrency miners, accessed the Azure PostgreSQL backend database to collect LiteLLM model and virtual-key records, and established persistence through SSH authorized-key modification and hidden relay files.

RAGFlow compromise intercepted new credentials

The RAGFlow intrusion took a different approach. Attackers modified the application startup path to install a hidden hook that wrapped the tenant LLM configuration flow. This allowed them to capture provider credentials—including API keys, model names, and endpoint metadata—whenever administrators added or modified LLM settings.

Microsoft observed initial reconnaissance through an outbound callback to a Burp Collaborator instance, followed days later by code execution within the RAGFlow Flask service. While several publicly documented vulnerabilities could explain the access path, including Jinja2 template injection flaws and a MinerU parser path-traversal issue, researchers did not attribute the intrusion to a specific CVE.

Kestra workflow platform enabled rapid exploitation

The Kestra compromise likely exploited CVE-2026-49869, an authentication-bypass vulnerability that allowed unauthenticated attackers to define malicious workflows and trigger shell execution in the worker runtime. Telemetry showed workflow-origin shell sessions accessing the mounted Docker socket, enumerating the container environment, deploying XMRig miners, and storing collected data through the application's key-value interface.

Recommendations for securing AI infrastructure

Microsoft recommends that defenders inventory exposed AI management surfaces, restrict administrative access to these platforms, and monitor for gateway-originated execution and secret access patterns. Organizations should treat AI gateways and orchestration platforms as high-value control points that require hardening, network segmentation, and dedicated monitoring.

These findings were first reported by Microsoft Security in a detailed analysis of AI infrastructure targeting patterns.