AI infrastructure intrusions: credential theft and cryptomining on LLM gateways

What is this?

On August 26, 2026, Microsoft Security Research published an analysis of intrusions against three separate AI workloads: a LiteLLM gateway, a RAGFlow deployment, and a Kestra workflow environment. The write-up is signed by Yash Gund and Sumith Maniath and draws on Microsoft Defender endpoint telemetry from the compromised hosts.

What makes it worth reading is not the sophistication — there isn’t much. The entry paths differ per product, but the objectives are the same in all three cases and they are entirely conventional: harvest credentials, establish persistence, and monetise the host with a cryptominer. No threat actor is named, and no nation-state attribution is offered. This is commodity crimeware finding a new class of exposed target.

That target is what Microsoft calls a control point: gateways, retrieval platforms and orchestration services now sit between users, applications, data and models, and in doing so they concentrate model-provider keys, database connection strings, tenant configuration and execution privileges in a single runtime.

How it works

The gateway (LiteLLM). Initial access is assessed with high confidence as exploitation of the exposed gateway surface — an authenticated command-execution flaw in the MCP stdio test endpoints, which public research from Horizon3.ai chains with a Starlette host-header validation bypass to reach unauthenticated code execution on vulnerable deployments. What follows is the interesting part. The gateway runs as PID 1 in its container, so the payload read /proc/1/environ and filtered it for keywords like master, API key, token and password. A self-contained Python one-liner then parsed DATABASE_URL out of that same environment, connected to the backing PostgreSQL instance, and dumped the model and virtual-key tables. Output was base64-encoded and exfiltrated in small chunks to out-of-band callback endpoints. Persistence came via SSH authorized-key modification, masqueraded service names and immutable file attributes; a crontab rewrite removed competing miners before installing its own.

The retrieval platform (RAGFlow). Microsoft is explicit that it has low confidence about which specific flaw enabled code execution here — the relevant paths run inside the RAGFlow Flask service process, and endpoint telemetry could not isolate the sink. Several publicly documented candidates exist, including template-injection issues in the prompt generator and agent workflow components, a parser path-traversal, and a sandbox bypass. The post-exploitation behaviour is the lesson: the attacker planted a hidden Python hook under the application tree, modified the import path so it loaded with the service, and wrapped the tenant LLM configuration flow. The hook did not steal stored keys — it captured provider credentials as administrators subsequently entered them, across OpenAI, Azure, Anthropic and Gemini configurations, suppressing errors so setup appeared to succeed. No miner was deployed in this case; the objective was purely credential interception.

The orchestrator (Kestra). Initial access is assessed with high confidence as an authentication bypass. The root cause is a textbook web-application bug with no AI in it: the authentication filter whitelisted the public configuration endpoint using a suffix match (endsWith("/configs")) rather than an exact path comparison. Because Kestra addresses resources through caller-chosen path segments such as namespace and flow ID, any path ending in that segment slipped past Basic Auth entirely — enough to create and run a workflow, and Kestra ships script-execution plugins by default. Shell execution followed from the worker lineage, then Docker socket access to enumerate the environment arrays of other containers reachable through the mounted runtime socket, then XMRig against a Monero pool.

Microsoft also notes that several payloads showed characteristics often associated with assisted or generated code — organised imports, explicit timeout handling, dependency fallbacks, defensive exception handling, explanatory comments. It frames this carefully as an observation about tooling, not evidence of attribution, and declines to draw any conclusion about authorship. We report it on the same terms.

Why it matters

The blast radius of an AI gateway is wider than most inventories reflect. A single compromised proxy yields the master key, every per-tenant virtual key it has issued, and a database connection string that leads somewhere else. The provider bill is the least of it: those keys usually carry access to whatever the organisation has wired the model into.

The RAGFlow case is the one to internalise. Credential rotation is the standard response to a suspected key leak — and against a hook sitting inside the configuration flow, rotation actively feeds the attacker. Every freshly minted key is captured at the moment it is entered. Any incident response on a retrieval or gateway platform has to establish that the application tree is clean before new secrets go anywhere near it.

Finally, the Kestra flaw is a reminder that the AI stack is absorbing general-purpose infrastructure faster than that infrastructure is being re-reviewed. A suffix-match authorisation check is a bug the web security community has understood for two decades. It became critical here because the component now sits in front of model credentials and container runtimes.

Defenses

Inventory and close the exposed management surfaces. Administrative and management interfaces for gateways, RAG platforms and orchestrators should not be reachable from the internet. This is the single control that would have prevented all three intrusions.

Patch the components named here. The Kestra authentication bypass is fixed in 1.0.45 and 1.3.21; treat earlier builds as unauthenticated-RCE-capable. Apply current LiteLLM and RAGFlow releases and their upstream framework fixes.

Get provider keys out of the process environment. The /proc/1/environ read only pays off if the keys are there. Inject secrets from a managed store at call time, issue per-team virtual keys with spend limits instead of sharing a master key, and rotate anything that lived on an exposed instance — after the integrity check below.

Apply least privilege between gateway and database. Run the proxy under a dedicated service account, restrict its database grants to the objects it actually needs, and put the database behind a private endpoint with restrictive firewall rules. Dumping a virtual-key table should not be something the gateway role can do.

Make egress deny-by-default. Allowlist model-provider and service endpoints; block direct connections to raw-IP hosts and non-standard ports; route permitted traffic through an FQDN-filtering proxy. Log and filter DNS — subdomain-encoded beacons and out-of-band callbacks are visible there before anything else fires.

Harden the host runtime. Mount temporary directories non-executable where operationally feasible, alert on execution from world-writable paths, and monitor changes to cron entries, SSH authorized-keys files and immutable-file attributes.

Verify application integrity before rotating credentials. Compare the deployed application tree and import paths against a known-good image, and treat any unexpected hook in a credential-configuration flow as a rotation blocker.

Detect on correlation, not on single events. None of these steps is individually alarming. The signal is the chain: an application-origin shell or interpreter, followed by secret access, followed by payload staging in a temporary directory, followed by an outbound callback. Microsoft’s own guidance is to monitor AI workloads according to their control-plane role rather than as isolated applications — and treat any SSRF-style probing of a retrieval platform as a precursor, since in the RAGFlow case code execution followed several days later.

Status

Item	Reference	Date	Notes
Microsoft investigation write-up	Microsoft Security Research	2026-08-26	Three workloads: LiteLLM gateway, RAGFlow, Kestra. No actor attribution
LiteLLM MCP stdio command execution	CVE-2026-42271 / GHSA-v4p8-mg3p-g94g	—	Authenticated command execution; high-confidence initial access in the gateway case
Starlette host-header validation bypass	CVE-2026-48710	—	Chained by public Horizon3.ai research to reach unauthenticated RCE
RAGFlow candidate flaws	CVE-2026-45312, CVE-2026-28797, CVE-2026-24770, CVE-2025-68700, CVE-2025-69286	—	Template injection, path traversal, sandbox bypass, account access. Low confidence — none confirmed as the sink
Kestra authentication bypass	CVE-2026-49869	—	CVSS 10. Suffix-match filter on the public config endpoint; fixed in 1.0.45 and 1.3.21
Mapped frameworks	OWASP LLM Top 10 (supply chain / excessive agency), MITRE ATT&CK T1190, T1552.001, T1496	2026	Exploit public-facing app → credentials from files → resource hijacking

Publication date of the primary source: August 26, 2026. Microsoft’s confidence levels differ by case and are reproduced above as published — high confidence on the LiteLLM and Kestra initial-access paths, low confidence on the RAGFlow execution sink.