Hackers Are Targeting AI Servers to Steal API Keys and Hijack Computing Power

AI infrastructure is rapidly becoming a high-value enterprise attack surface.

Attackers targeting LiteLLM AI gateways, RAGFlow retrieval platforms, and Kestra workflow orchestration environments to steal model-provider credentials, establish persistence, access backend data, and deploy cryptominers.

The appeal is clear. AI gateways often centralize OpenAI, Azure, Anthropic, Gemini, and other provider API keys; retrieval platforms hold tenant-level LLM configuration and sensitive documents; while orchestration systems can execute workflows with access to containers, secrets, and internal services.

A single compromise can therefore expose far more than one application instance.

Microsoft’s investigation into LiteLLM illustrates the risk. Attackers likely exploited an exposed LiteLLM gateway through an attack path involving CVE-2026-42271, a command-injection flaw in Model Context Protocol preview endpoints.

The vulnerability permits command execution in the proxy process context and affects LiteLLM versions 1.74.2 through 1.83.6; it was fixed in version 1.83.7.

Researchers also demonstrated that CVE-2026-42271 can be chained with CVE-2026-48710, a Starlette Host-header validation bypass known as BadHost.

In vulnerable deployments, the chain can remove the API-key authentication requirement and produce unauthenticated remote code execution, turning an internet-exposed AI gateway into a direct entry point.

They also accessed /proc/1/environ, a particularly valuable source in containerized deployments where the gateway runs as PID 1.

The stolen PostgreSQL connection details were then used to query LiteLLM backend tables containing proxy virtual keys, model configuration, provider endpoints, and potentially upstream credential material.

Microsoft Researchers said that, the activity shows that attackers increasingly view AI services not as standalone applications, but as privileged control planes connecting users, models, databases, containers, and cloud services.

AI Servers to Steal API Keys

The intrusion did not stop at credential theft. Microsoft observed Python droppers, masqueraded ELF payloads, service-like process names, SSH authorized-key changes, hidden-file execution, immutable file attributes, and cron manipulation.

After gaining execution, the LiteLLM attackers harvested runtime environment variables, including provider API keys, LiteLLM master keys, database URLs, tokens, passwords, and UI credentials.

Attackers also deployed XMRig-like mining components and used RandomX-related CPU tuning, demonstrating how compromised AI gateways can become both credential-harvesting platforms and profitable compute resources.

RAGFlow attacks followed a different path but pursued the same outcome. Microsoft observed possible SSRF-style reconnaissance, followed by code execution and modification of the application’s startup or import path.

The attacker placed a Python hook in the TenantLLM credential-configuration flow, allowing it to silently intercept provider type, model name, endpoint metadata, and API keys whenever administrators configured or updated an LLM integration.

Microsoft did not attribute the RAGFlow compromise to one confirmed CVE, although multiple publicly documented flaws provide relevant technical context.

Kestra deployments were also targeted through CVE-2026-49869, an authentication-bypass vulnerability affecting Kestra OSS versions before 1.0.45 and 1.3.21.

The flaw allowed unauthenticated attackers to create and execute workflows because authentication logic used an unsafe suffix match for paths ending in /configs.

Since Kestra includes shell and Python execution plugins, attackers could turn workflow creation into remote code execution inside the worker container.

In the observed Kestra activity, attackers used workflow-origin shell execution to inspect Docker sockets, enumerate container environment variables, collect secrets, deploy XMRig, and communicate with mining infrastructure.

Docker socket access is especially dangerous because it can expose credentials, configuration, and metadata belonging to other running containers.

Organizations should treat AI gateways, RAG systems, and workflow engines as Tier-0 infrastructure.

Patch exposed services, restrict administrative interfaces behind VPN or zero-trust controls, eliminate unnecessary internet exposure, rotate credentials accessible to affected processes, and avoid placing long-lived secrets in environment variables.

Security teams should also correlate application-originated shell activity with secret reads, startup-file modifications, Docker socket access, outbound callback traffic, cron changes, and execution from temporary directories.

AI systems are now part of the enterprise control plane and attackers are already exploiting that concentration of trust.

IOCs

IOC	Type	Role
45.150.109[.]151	IPv4	Scanning/recon infrastructure – multiple targeted AI workloads
135.125.10[.]56:19888	IPv4:port	RAGFlow exploitation C2 — LLM API key exfiltration endpoint
172.232.38[.]92:32991	IPv4:port	Kestra reverse shell C2 (Linode VPS)
45.150.109.151.sslip[.]io	Domain	DNS rebinding used in LiteLLM attacks to evade domain reputation checks
auto.c3pool[.]org:443	Domain:port	XMRig Monero mining pool (Kestra)

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

★ Which Security Tools Should You Cut? Score Them on One Page – Download the Inherited Security Stack Guide