AI Infrastructure Security: Why Attackers Now Target Gateways, Not Models

On August 26, 2026, Microsoft Security Research published a detailed account of what happens when AI infrastructure becomes the target. In three real intrusions, attackers went after the gateways and control points of AI systems — not the models themselves. The victims were a LiteLLM gateway, a RAGFlow deployment, and a Kestra workflow environment. The objectives across all three were strikingly similar: steal credentials, establish persistence, and hijack compute for cryptocurrency mining.[1]

Why AI Infrastructure Is the New Attack Surface

AI is creating a new layer of enterprise infrastructure. Gateways, retrieval platforms, orchestration services, and containerized runtimes now sit between users, applications, data, and models. Microsoft's researchers describe these systems as concentrating "credentials, data access, model connectivity, and execution privileges" — making them some of the most powerful components in the AI stack.[1]

That concentration of trust is exactly what attackers are learning to target. Instead of attacking the model itself, they attack the control plane around it: the proxy that holds the API keys, the retrieval platform that stores tenant configuration, the orchestrator that can run arbitrary workflows. One compromised gateway can expose every provider key, every downstream database connection, and the compute it runs on.

What Microsoft Actually Saw: Three Compromised AI Workloads

The campaign-level signal extends beyond any single product. The three workloads served different functions, but each exposed assets that could support follow-on abuse — model-provider keys, proxy-issued virtual keys, database connection strings, tenant configuration, workflow execution, and host compute.[1]

Case Study 1: The LiteLLM Gateway — Credentials First, Then the Database

LiteLLM is commonly deployed as a proxy or gateway between applications and model providers. In that position it may hold model-provider keys, LiteLLM master keys, virtual-key records, database connection strings, routing configuration, and tenant policy data. Command execution in the gateway runtime therefore exposed a process context sitting next to AI routing and credential material.[1]

Initial access: a two-CVE chain

Microsoft assesses with high confidence that initial access came through exploitation of the exposed LiteLLM gateway surface. Public vulnerability paths include CVE-2026-42271, an authenticated command-execution issue in LiteLLM's MCP stdio test endpoints, and research that chains it with CVE-2026-48710, a Starlette host-header validation bypass, to achieve unauthenticated remote code execution in vulnerable exposed deployments.[1][2] In the observed case, the gateway service itself became the execution origin.

The six-stage attack chain

1. Credential harvesting. The payload read the gateway process environment — in containerized deployments the gateway runs as PID 1, so /proc/1/environ exposed the full environment block. It filtered for keywords like master, API key, token, password, and UI-related fields, then exfiltrated via multiple transports (Python urllib, curl, wget) as fallbacks if one outbound method was blocked.[1]
2. Payload delivery. A masqueraded ELF binary was retrieved from attacker infrastructure, staged under a temporary path, and launched with command-line arguments resembling a Linux service process. A second path used a shell-stage downloader with short timeouts and fallback behavior — redundant retrieval and execution from the gateway process context.[1]
3. Host discovery. The payload fingerprinted the host, checked privilege boundaries, inspected listening ports, and swept for other miner or remote-access activity on the system.[1]
4. Mining preparation. Telemetry showed XMRig or XMRig-like components, RandomX-related tuning — including loading the Linux Model-Specific Register (MSR) module with write access — and a crontab rewrite that removed entries belonging to competing miners.[1]
5. Database access. Using the harvested connection string, a self-contained python3 one-liner parsed DATABASE_URL, connected to the LiteLLM-backed PostgreSQL data tier (Azure Database for PostgreSQL in this case), and dumped records from LiteLLM_ProxyModelTable and LiteLLM_VerificationToken — model configuration, upstream provider key material, provider endpoints, and proxy-issued virtual keys. Output was base64-encoded and exfiltrated in small chunks to an out-of-band callback endpoint.[1]
6. Persistence. Service-account SSH authorized-key modification, hidden-file relay execution, masqueraded systemd service names, self-relaunch loops, and immutable-file attributes.[1]

Impact: provider credential exposure, proxy-issued key exposure, database-backed configuration access, host resource abuse, and durable service-account access. The gateway role made these impacts broader than a standard single-process application compromise.[1]

Case Study 2: RAGFlow — The Credential-Interception Hook

RAGFlow supports document-processing and retrieval-augmented generation workflows and stores tenant LLM configuration. The affected code paths process provider credentials when users add or modify LLM settings — exactly where an attacker wants to sit.[1]

Microsoft assesses with high confidence that initial access came through the exposed RAGFlow application surface: telemetry showed the server process retrieving an attacker-supplied URL through its own HTTP client (a Burp Collaborator callback), with remote code execution in the same service context following days later. The specific vulnerability is unconfirmed; Microsoft lists plausible public paths including CVE-2026-45312 and CVE-2026-28797 (authenticated Jinja2 server-side template injection in the prompt generator and Agent workflow components), CVE-2026-24770 (a MinerU parser path-traversal allowing arbitrary file overwrite), and CVE-2025-68700 (a Canvas CodeExec sandbox bypass).[1]

Once inside, the attackers created a hidden runtime hook under the application tree, modified the startup or import path so the hook loaded with the RAGFlow service, and wrapped the tenant LLM configuration flow. The hook captured newly supplied provider metadata — provider type, model name, API key material, endpoint metadata — and sent it out via HTTP from inside the container while suppressing errors so the application kept working.[1]

Impact: primarily LLM credential collection rather than host monetization. The startup-path modification could persist across service restarts, meaning credentials configured after the hook was installed were also at risk.[1]

Case Study 3: Kestra — Workflow Execution as a Shell

Kestra is a workflow orchestration environment. Because workflows are designed to execute tasks and interact with external systems, abuse of workflow-creation and execution capabilities provides direct code execution in the worker runtime.[1]

Initial access came through CVE-2026-49869, a critical authentication-bypass vulnerability: the auth check was a suffix match, so any API path ending in /configs bypassed it entirely, letting an unauthenticated attacker define a malicious workflow using the Process runner and trigger worker-side shell-script execution. Public records confirm the fix shipped in Kestra 1.0.45 and 1.3.21.[1][3][4]

The observed chain then used that workflow-origin shell to access the mounted Docker socket from inside the orchestration environment, querying container metadata and environment arrays — exposing cloud keys, database passwords, API tokens, and internal service endpoints from other containers. A monetization phase followed: miner retrieval from a public release source, archive extraction, binary renaming, background execution, mining-pool communication, and RandomX/XMRig CPU tuning. A later event used a curl-pipe-shell pattern and stored collected output through Kestra's own key-value interface.[1]

Impact: shell execution through the workflow engine, container-environment exposure via the Docker socket, host resource hijacking through miner deployment, and follow-on collection through workflow task execution.[1]

The Pattern That Matters for Your Business

Initial access differed by workload, but the observed objectives were consistent: credential collection, durable access mechanisms, and resource monetization. Microsoft's guidance to defenders is to monitor AI workloads according to their control-plane role, not as isolated applications — gateway, retrieval, and orchestration services concentrate credentials, database access, workflow execution, and container privileges in one runtime.[1]

You may not run LiteLLM, RAGFlow, or Kestra. But your AI stack has the same shape. ChatGPT Enterprise and Copilot admin consoles, Zapier and Make automations, AI support agents, internal RAG tools, and any custom AI integration all concentrate credentials and data access in a handful of control points. The question for an AI agent security audit is no longer just "what can the model do?" — it's "what can the infrastructure around the model do, and who can reach it?"

The AI Infrastructure Security Audit Checklist: 12 Control Points

Microsoft's research gives audits a concrete new checklist area. Here is the infrastructure-level checklist it implies, written for a small business without a dedicated security team:

Microsoft's Mitigation Guidance, Translated for Small Business

Microsoft's recommendations map cleanly to small-business scale. The ones that matter most:

• Treat AI gateways as Tier-0 secrets stores. Keep them patched, require authentication across API and UI surfaces, restrict administrative and management ports, and don't expose management interfaces to the internet.[1]
• Scope and protect provider credentials. Issue per-team virtual keys with spend limits instead of sharing master keys, store upstream API keys in a managed secret store rather than process environment variables, and rotate credentials associated with any exposed gateway.[1]
• Apply least privilege to gateway and database access. Dedicated service accounts, database permissions limited to required objects, private endpoints with restrictive firewall rules.[1]
• Constrain outbound traffic. Deny-by-default egress, allowlist only required model-provider endpoints, block direct connections to raw-IP hosts and non-standard ports.[1]
• Monitor outbound callbacks. Log DNS for out-of-band callbacks and subdomain-encoded beacons; watch for connections to command-and-control and OAST domains.[1]
• Harden the host runtime. Mount temporary directories as non-executable where feasible, alert on execution from world-writable paths, monitor changes to cron entries, SSH authorized_keys files, and immutable-file attributes.[1]

None of these require a security team. They are configuration decisions, and they are the difference between the LiteLLM compromise ending at a stolen key and ending at a hijacked database and a cryptominer on your server.

How to Audit Your AI Infrastructure in 5 Steps

If you're asking "how do I audit AI infrastructure," start here — this is the operational version of the checklist above:

1. Map the control plane. Find every gateway, retrieval platform, orchestration service, and agent runtime in your stack — including the ones embedded in SaaS tools you rent.
2. Test the management surface. Check which admin interfaces are reachable from the internet, whether they require authentication, and whether the underlying tools are patched against known CVEs (start with CVE-2026-42271, CVE-2026-48710, CVE-2026-49869).
3. Audit secret concentration. List every API key, token, and connection string your AI stack holds, where it's stored, who can read it, and whether keys are scoped with spend limits.
4. Constrain and monitor. Set deny-by-default egress, block raw-IP and non-standard-port connections, and add alerts for AI services spawning shells or accessing secret files.
5. Re-audit on change. Every new AI tool, vendor, or workflow is a new control point. The safeguards that failed in these cases were all configurable before the intrusion.

Frequently Asked Questions

Bottom Line: Audit the Control Plane, Not Just the Model

Microsoft's three case studies are the clearest evidence yet that AI security has moved from the model layer to the infrastructure layer. Attackers don't need to break the AI — they need to break the gateway that holds the keys, the retrieval platform that stores the configuration, or the orchestrator that can run the shell.[1]

The good news is that the mitigations are mostly configuration: patch, don't expose, scope the keys, constrain egress, and watch for the control-plane signals Microsoft documented. If an AI service in your stack can spawn a shell, read its own environment, or reach a database it doesn't need, that is your attack surface — and now you know exactly how attackers will use it. For the agent-level layer of the same problem, see prompt injection and AI agent backdoors; for the broader picture, start with AI agent security risks.

Sources

• Microsoft Security Research — "When AI infrastructure becomes the target: Securing gateways and control points" (Aug 26, 2026): microsoft.com/en-us/security/blog
• Horizon3.ai — CVE-2026-42271 chained with CVE-2026-48710 (LiteLLM unauthenticated RCE): horizon3.ai
• CIRCL Vulnerability-Lookup — CVE-2026-49869 (Kestra auth bypass, fixed in 1.0.45 / 1.3.21): vulnerability.circl.lu
• TheHackerWire — Kestra critical RCE: unauthenticated workflow execution (CVE-2026-49869): thehackerwire.com
• NVD — CVE-2026-42271: nvd.nist.gov; CVE-2026-49869: nvd.nist.gov

Accuracy note: All facts, dates, CVEs, and attack-chain details verified against the Microsoft Security Research post (Aug 26, 2026) and public CVE/advisory records on 2026-08-26. The two headline vulnerabilities (LiteLLM CVE-2026-42271 + CVE-2026-48710 chain; Kestra CVE-2026-49869) were corroborated via Horizon3.ai, CIRCL Vulnerability-Lookup, and TheHackerWire. Microsoft's assessments of initial access for the RAGFlow case remain low-confidence on the specific vulnerability, and this article reflects that.