Attackers Target AI Gateways for Credentials and Cryptomining

According to CyberPress, after obtaining execution in a LiteLLM deployment, attackers harvested environment variables from /proc/1/environ. In containerized services, that file can expose runtime configuration, including provider API keys, application master keys, database connection strings, passwords, and access tokens.

The same report states that the actors accessed LiteLLM's PostgreSQL database and collected model-configuration and virtual-key records. They then staged payloads in temporary directories, used filenames resembling legitimate Linux services, and deployed XMRig cryptomining software.

CyberPress further reports attempts to remove rival miners, alter SSH authorized_keys, modify cron jobs, and apply immutable file attributes. Those techniques can provide multiple persistence paths and complicate incident cleanup.

CyberPress reports that a RAGFlow intrusion included suspected SSRF-style reconnaissance followed by modifications to application files in a container. The attackers created a hidden Python hook that intercepted details submitted when administrators added or updated LLM provider configurations, including provider names, model names, API-key material, and endpoint metadata. The hook reportedly sent the data to attacker-controlled infrastructure while allowing normal configuration actions to continue.

For Kestra, Mallory.ai's summary of Microsoft's research reports that Microsoft assessed with high confidence that attackers likely used CVE-2026-49869 to bypass authentication, create a malicious workflow, and obtain shell execution on a worker. The reported activity included access to the Docker socket and container environment data, deployment of XMRig connected to a Monero mining pool, and later collection of data through Kestra's key-value interface.

The common element across the reported cases is privileged connectivity. LiteLLM gateways can centralize credentials for multiple model providers. Retrieval systems may hold tenant-level LLM settings and access to sensitive data sources. Workflow orchestrators can run jobs with access to secrets, containers, and internal services.

For security teams, the incidents reinforce a broader pattern in cloud-native application security: services that broker identity, execution, data access, and external APIs create unusually valuable targets when internet-exposed. A compromise of such a service can create a path to credentials and downstream systems beyond the initially breached workload.

Microsoft advised organizations to treat AI gateways, retrieval platforms, and workflow orchestration tools as critical control-plane infrastructure, according to Mallory.ai. The reported attack chains also make routine controls especially relevant for AI platform operators: prompt patching of internet-facing components, strict network exposure policies, secret rotation after suspected compromise, monitoring of container environment access, and review of persistence mechanisms such as SSH keys, cron entries, and unexpected immutable files.