The Growing Threat Landscape of AI Infrastructure
As artificial intelligence (AI) continues to permeate various sectors, it is setting the stage for an alarming surge in cybersecurity threats targeting its underlying infrastructure. Recent reports highlight that AI infrastructure is evolving into a high-value enterprise attack surface, drawing the interests of malicious actors seeking to exploit vulnerabilities for financial gain and access to sensitive information.
Attackers are turning their focus toward LiteLLM AI gateways, RAGFlow retrieval platforms, and Kestra workflow orchestration environments. Their objectives range from stealing model-provider credentials to establishing persistence, gaining access to backend data, and deploying cryptominers. The motivations are evident: these AI gateways serve as centralized points that often consolidate sensitive API keys from major providers such as OpenAI, Azure, Anthropic, and Gemini. Retrieval platforms typically hold tenant-level large language model (LLM) configurations and critical documents, while orchestration systems can execute workflows that have direct access to containers, secrets, and internal services. Thus, a single compromise can potentially expose a rich tapestry of interconnected resources beyond just one application instance.
In an illuminating case, Microsoft’s recent investigation into LiteLLM underscores these risks. The inquiry revealed that attackers likely capitalized on an exposed LiteLLM gateway, exploiting a command injection vulnerability tracked as CVE-2026-42271. This particular flaw allows for command execution within the proxy process context and affects LiteLLM versions 1.74.2 to 1.83.6, with remedial measures initially introduced in version 1.83.7. Beyond this specific vulnerability, researchers demonstrated that CVE-2026-42271 could be combined with another vulnerability known as CVE-2026-48710, a Starlette Host-header validation bypass referred to as BadHost. In vulnerable configurations, attackers could sidestep the API-key authentication requirement and achieve unauthenticated remote code execution, effectively transforming an exposed AI gateway into a significant entry point for malicious activities.
Upon breaching the LiteLLM environment, intruders accessed /proc/1/environ, which offers invaluable insights in containerized deployments where the gateway runs as PID 1. They then utilized stolen PostgreSQL connection details to probe LiteLLM’s backend tables, which contain proxy virtual keys, model configurations, provider endpoints, and potentially other sensitive credential material.
According to Microsoft researchers, this activity signifies a shift in how attackers perceive AI services; they no longer regard them as standalone applications but as integral control planes that connect users, models, databases, containers, and cloud services. This realization has crucial implications for how enterprises must secure their AI ecosystems.
The intrusion did not merely end with credential theft. Microsoft tracked a variety of malicious activities, including the deployment of Python droppers, disguised ELF payloads, and the manipulation of cron jobs. Attackers cleverly harvested environment variables during runtime, acquiring provider API keys, LiteLLM master keys, database URLs, tokens, passwords, and UI credentials. More alarmingly, they installed malicious components that operated similarly to XMRig mining software, efficiently turning compromised AI gateways into both credential-harvesting platforms and lucrative computing resources.
The assault on RAGFlow took a different route yet aimed for the same result. Microsoft observed possible server-side request forgery (SSRF) reconnaissance, leading to code execution and alterations in the application’s startup or import paths. By injecting a Python hook into the TenantLLM credential-configuration flow, attackers were able to surreptitiously intercept metadata and API keys associated with LLM configurations whenever administrators initiated changes.
The Kestra deployments faced targeting through CVE-2026-49869, an authentication-bypass vulnerability affecting earlier versions of Kestra. This flaw enabled unauthenticated attackers to create and execute workflows indiscriminately, as the authentication logic failed to securely validate paths ending in /configs. Attackers exploited this vulnerability to gain remote code execution capabilities inside the worker container.
The scenario is especially precarious given that Kestra includes plugins for shell and Python execution, allowing for a myriad of malicious activities to unfold. The observed actions within Kestra included the inspection of Docker sockets and the enumeration of container environment variables and secrets, facilitating not only the acquisition of sensitive data but also the deployment of mining operations.
Given the escalating risks associated with AI gateways, RAG systems, and workflow engines, organizations are urged to treat these as Tier-0 infrastructure. Security measures should include patching exposed services, restricting administrative interfaces through Virtual Private Networks (VPNs) or zero-trust protocols, eliminating unnecessary internet exposure, and rotating credentials that are accessible to potentially vulnerable processes. Additionally, security teams must pay close attention to application-originated shell activities, correlating them with secret reads, modifications to startup files, Docker socket access, and unusual outbound traffic patterns.
AI systems have now integrated deeply into the enterprise control plane, presenting a significant opportunity for attackers to exploit a concentrated trust environment. The growing sophistication of threats emphasizes the need for organizations to bolster their defenses against this evolving menace. As the nexus between AI and enterprise security deepens, the imperative for heightened vigilance has never been more critical.