Attackers target AI gateways, retrieval systems and workflow services

Microsoft’s 26 August report examines intrusions involving LiteLLM, RAGFlow and Kestra environments. The company says attackers targeted credentials, persistence and compute resources held in systems connecting users, models and business data. The investigated paths differed across workloads.

These services can hold provider keys, database connections, workflow configuration and execution privileges. That makes their exposure a separate security concern from the quality of the model behind them. Microsoft’s cases connect host compromise with access to those surrounding resources. The findings support inventorying and reviewing the actual gateway and orchestration deployment, rather than assuming that a service is low-risk because its visible purpose is forwarding model requests.