Microsoft Warns Adversaries Are Targeting AI Gateways and Orchestration Planes

Microsoft Threat Intelligence recently published threat research detailing real-world compromises targeting the emerging enterprise AI middleware tier. Adversaries systematically targeted internet-exposed instances of the LiteLLM proxy gateway, RAGFlow retrieval pipelines, and Kestra workflow automation environments. By chaining vulnerabilities—including unauthenticated remote code execution paths in LiteLLM (CVE-2026-42271 chained with CVE-2026-48710) and critical authentication bypass flaws in Kestra (CVE-2026-49869)—attackers harvested LLM provider API keys, injected runtime Python credential hooks, gained Docker socket access, and deployed cryptomining payloads. This development shifts the AI security threat model from theoretical prompt injection to direct infrastructure takeover. AI gateways and orchestration platforms act as central convergence points: they store high-privilege keys for commercial model APIs, maintain persistent database connections for retrieval-augmented generation (RAG), and coordinate execution across underlying compute nodes. A compromise of a gateway like LiteLLM allows an attacker to intercept all organizational prompts, clone virtual proxy credentials, siphon proprietary knowledge bases, and use provisioned cloud GPUs for unauthorized compute. The campaign illustrates a natural progression in cloud-native AI adoption. In the rush to deliver generative AI capabilities, organizations frequently deploy open-source orchestration layers and routing proxies in perimeter-adjacent environments without enterprise-grade authentication or network isolation. Similar to early Kubernetes adoption where unauthenticated dashboards led to widespread cluster compromises, AI control-plane software is now experiencing targeted automated scanning and rapid exploit weaponization. Attackers treat these management planes as high-yield transit hubs to bypass perimeter defenses. For platform and security teams, AI gateways must immediately be classified and defended as Tier-0 infrastructure. AI proxies and orchestration UI endpoints should never be exposed to the public internet without strict identity-aware access proxies and mutual TLS. Teams must enforce granular runtime egress filtering to block out-of-band reverse shells, restrict Docker socket mounting from AI containers, and isolate database connections using ephemeral credentials rather than static environment variables. Furthermore, security operations centers must deploy behavioural telemetry tuned to detect unexpected child process execution stemming from AI runtime processes.