Attack Surface: AI Gateways as the New Bottleneck
Attackers compromised LiteLLM, RAGFlow, and Kestra deployments to extract API keys, query internal databases, and run XMRig miners on stolen compute. For quant operations running model inference, retrieval pipelines, or orchestrated trade logic in the cloud, the blast radius is total — provider credentials, database URLs, and container access live on the same node.
Mechanics of Compromise
LiteLLM. The intrusion chain links to CVE-2026-42271 (command-execution flaw in MCP stdio endpoints) and CVE-2026-48710 (Starlette host-header validation bypass). Post-exploitation, attackers read environment variables from /proc/1/environ, harvesting model-provider API keys, master keys, and database credentials. They then queried the LiteLLM PostgreSQL database for virtual-key records and model configuration. Persistence was layered: SSH authorized_keys modification, cron job insertion, immutable file attributes to resist cleanup, XMRig deployment after evicting competing miners.
RAGFlow. Suspected SSRF reconnaissance preceded modification of application files inside the container. A hidden Python hook was injected that intercepted credentials at the moment administrators added or updated LLM provider settings — provider name, model identifier, API key material, endpoint metadata — and exfiltrated them while letting the configuration write complete normally. The legitimate UI flow continued uninterrupted.
Kestra. Workflow orchestration platform, simplest path: CVE-2026-49869, an authentication bypass allowing an unauthenticated actor to create and execute a malicious workflow. Shell access followed.
Risk-Adjusted Verdict
Microsoft assessed the attacks as demonstrating that AI infrastructure should be treated as critical control-plane technology rather than standard application-layer tooling. The framing is correct. A compromised gateway exposes credentials for every downstream model call. A compromised retrieval system captures new keys in real time. A workflow engine grants container-level execution to anonymous traffic.
For algorithmic trading operations, the mitigation set is bounded but strict:
- Run gateway, retrieval, and orchestration processes under dedicated service accounts with least-privilege IAM
- Rotate provider keys on a fixed cadence independent of any suspected incident
- Alert on reads of
/proc/1/environand adjacent process-environment scraping patterns - Treat workflow orchestration endpoints as public-facing surfaces; enforce auth, rate limits, and payload inspection equivalent to public APIs
- Segment AI infrastructure from trading execution clusters; never co-locate credentials
The attackers in this cluster were mining Monero on stolen compute. The more efficient attack — redirecting inference traffic, draining funded exchange accounts via harvested keys, or front-running signals across strategies sharing a compromised gateway — has not yet been documented at scale. The prerequisites are visible. The expected value of a defensive posture upgrade exceeds the operational cost by a wide margin.
The same logic of borrowed components carrying inherited exposure shows up elsewhere when independent domains collide — see this analysis of conflicting narratives across cultural frontlines for a parallel framing of structural risk.