Overview
Microsoft Security Research has published findings from active intrusion investigations targeting three AI infrastructure components: a LiteLLM API gateway, a RAGFlow retrieval-augmented generation platform, and a Kestra workflow orchestration environment. Published in August 2026, the report identifies a consistent attacker pattern across these otherwise distinct workloads — threat actors are treating AI middleware as a privileged control plane, seeking credentials, persistence, and monetisable compute rather than targeting AI model outputs directly.
The significance of this shift is substantial. While much AI security discourse has focused on prompt injection and model manipulation, these cases demonstrate that the infrastructure surrounding AI — the gateways, retrieval stores, and orchestrators — represents an equally critical and increasingly targeted attack surface.
Technical Analysis
Each compromised workload served a different architectural function, but all three exposed assets enabling follow-on abuse:
- LiteLLM gateway: Concentrates model-provider API keys and proxy-issued virtual keys. Compromise grants attackers the ability to make authenticated requests to upstream LLM providers, enabling API key theft and unauthorised inference at the organisation’s expense.
- RAGFlow deployment: Stores database connection strings, indexed document content, and tenant configuration. Attacker access enables credential harvesting from the retrieval backend and potential exfiltration of sensitive embedded documents.
- Kestra workflow environment: Provides workflow execution privileges and host compute access. Post-compromise behaviour here focused on establishing persistence and monetising compute resources, consistent with cryptomining or infrastructure resale campaigns.
Intrusion paths varied across cases, but post-compromise objectives converged: steal credentials, establish persistence, and abuse compute. Microsoft noted that the broader campaign-level pattern — targeting AI management surfaces specifically — is more significant than any individual technique.
Framework Mapping
The attack pattern maps directly to several ATLAS and OWASP categories. AML.T0083 (Credentials from AI Agent Configuration) and AML.T0082 (RAG Credential Harvesting) are directly observed. AML.T0084 (Discover AI Agent Configuration) captures the reconnaissance phase. AML.T0040 (AI Model Inference API Access) reflects the LiteLLM exploitation objective. From an OWASP perspective, LLM06 (Sensitive Information Disclosure) applies to API key and connection string exposure, while LLM07 (Insecure Plugin Design) and LLM08 (Excessive Agency) reflect the risk of over-privileged AI infrastructure components.
Impact Assessment
Organisations running self-hosted AI orchestration stacks face compounded risk: a single compromised gateway can yield model-provider credentials, downstream data access, and host-level execution. Financial impact includes unauthorised LLM API spend and potential data exfiltration. The threat is particularly acute for enterprises that have deployed AI infrastructure rapidly without applying the same access controls and monitoring used for traditional critical systems.
Mitigation & Recommendations
- Inventory AI management surfaces: Map all gateways, RAG backends, orchestrators, and containerised runtimes to understand the credential and execution attack surface.
- Rotate and vault credentials: Treat LLM API keys, virtual proxy keys, and database connection strings as high-value secrets; store in dedicated secret managers with automatic rotation.
- Apply least-privilege access: Restrict administrative interfaces to AI infrastructure using network segmentation, RBAC, and MFA.
- Monitor for anomalous inference spend: Alert on unexpected spikes in model API usage that may indicate credential abuse.
- Harden container runtimes: Apply runtime security controls and image scanning to containerised AI workloads.