Attackers Target AI Infrastructure Gateways, Exploiting Vulnerabilities for Credential Theft and Compute Monetization
Microsoft details three investigations where attackers targeted AI infrastructure, including LiteLLM gateways, RAGFlow, and Kestra, exploiting vulnerabilities to steal credentials and monetize compute resources.
Microsoft has detailed recent investigations into attacks targeting critical AI infrastructure, highlighting how these systems are becoming high-value control points for threat actors. The investigations focused on three distinct AI workloads: a LiteLLM gateway, a RAGFlow deployment, and a Kestra workflow environment. In each case, attackers aimed to steal credentials, establish persistence, and ultimately monetize compromised compute resources.
These AI workloads, including gateways, retrieval platforms, and orchestration services, concentrate sensitive assets such as model-provider keys, database connection strings, and execution privileges. This concentration makes them attractive targets, akin to other critical enterprise infrastructure. Microsoft's analysis indicates that attackers are treating these AI platforms as control planes, converging credential theft, host compromise, and downstream data access.
The LiteLLM gateway compromise saw attackers exploit exposed surfaces, likely through a chain involving CVE-2026-42271 (authenticated command execution) and CVE-2026-48710 (Starlette host-header bypass). This allowed for remote code execution, leading to credential harvesting from the gateway's runtime environment, including model-provider API keys and database connection strings. The attackers then deployed miners to monetize compute resources and established persistence.
In the RAGFlow compromise, initial reconnaissance via SSRF-style methods was followed by code execution. Attackers modified application paths and injected a Python hook into the credential-configuration flow, aiming to intercept newly configured LLM provider credentials and model metadata. While not attributed to a specific vulnerability, the attack targeted the sensitive credential management aspects of the RAGFlow deployment.
The Kestra workflow environment was also targeted, with attackers exploiting its orchestration surface, potentially leveraging CVE-2026-49869. Observed activity included shell execution originating from workflows, discovery of container environments, and the deployment of XMRig miners. The objective was to gain secret discovery, container-level access, and rapidly monetize compute resources.
Microsoft advises organizations to inventory exposed AI management surfaces, restrict administrative access, and monitor for suspicious gateway-originated execution and secret access. The findings underscore the need for robust security scrutiny of AI infrastructure, treating it with the same rigor as traditional critical systems.
Across these incidents, several MITRE ATT&CK techniques were observed, including Credential Harvesting (T1003), Execution (T1059), and Resource Development (T1587). The pattern of targeting AI infrastructure as a control plane is a significant trend that security teams must address proactively.
Organizations deploying AI systems should prioritize securing these gateways and orchestration layers. This includes implementing strong authentication, regular vulnerability scanning, and continuous monitoring for anomalous activities. The evolving threat landscape necessitates a comprehensive security strategy that accounts for the unique risks posed by AI infrastructure.