AI Gateways Like LiteLLM Are Becoming Prime Targets for Attackers

Many businesses now use AI gateways such as LiteLLM to manage access to AI tools like ChatGPT, Claude, or Azure OpenAI. Instead of giving every employee or app a real provider key, the gateway issues 'virtual keys' and routes all AI traffic through one central point, making it easier to manage and monitor.

New research from Embrace The Red shows this convenience also creates a tempting target. If an attacker obtains admin-level access to the gateway, they can reroute AI traffic, intercept data, steal backend provider keys, or even alter the responses an AI tool sends back. Importantly, this abuse does not require a software bug; it uses the gateway's normal admin features. The real risk lies in an attacker getting hold of an admin credential in the first place. The researchers also note that LiteLLM and similar tools have had genuine security vulnerabilities in recent months, including at least one added to CISA's Known Exploited Vulnerabilities catalogue, confirming real-world attacks have occurred.

The researchers frame this as a strong candidate for authorised 'red team' or 'purple team' testing exercises, where security teams simulate these attacks to check their monitoring and controls actually catch this kind of abuse before it happens for real.