AI Gateway Security: A New Frontline for Enterprise Risk
Enterprise AI gateway security is the practice of protecting the services that sit between large language models and business data sources, tools, and external systems, where any flaw or misconfiguration can allow attackers to execute code, exfiltrate sensitive content, or hijack model behavior across multiple downstream applications at once. Recent disclosures in LiteLLM, Google Vertex AI, and Microsoft Copilot show a shared pattern: AI infrastructure is being deployed faster than it is being governed. Gateways and assistants inherit powerful permissions but lack scoped access controls, service account governance, and detailed audit trails. As models gain authority to query document stores, internal APIs, and collaboration platforms, a single compromise can affect everything the AI fabric can reach. These incidents mark a shift from model-specific risks toward platform-level vulnerabilities that span code execution, data theft, and stealthy policy bypass inside core enterprise environments.
LiteLLM Vulnerability: CISA Flags AI Gateways as High-Value Targets
CISA has added CVE-2026-42271, a command injection bug in LiteLLM, to its Known Exploited Vulnerabilities catalog, highlighting sustained targeting of AI gateway infrastructure. The flaw lives in Model Context Protocol test endpoints that accept user input and pass it into system-level operations without proper sanitization. On its own, exploitation requires credentials. When chained with CVE-2026-48710, an authentication bypass affecting the same platform, forged host headers can remove that requirement and lead to unauthenticated remote code execution for anyone who can reach the gateway. According to CISA, federal civilian agencies must remediate by June 22 under Binding Operational Directive 22-01. The problem is not only a coding bug but weak service account governance: LiteLLM exposes more than 200 data connectors, and the gateway often stores the credentials for all of them, with minimal network scoping or auditing of who can hit MCP endpoints and from where.
Vertex AI Bucket Squatting: Hijacking Models with “Pickle in the Middle”
In Google Cloud Vertex AI, a flaw in the Python SDK allowed attackers to hijack model uploads through a technique dubbed “Pickle in the Middle.” If a user did not explicitly set a storage bucket, the SDK generated a predictable bucket name based on project ID and region, checked if it existed, but did not verify ownership. An attacker needed only their own Google Cloud project and the victim’s project ID, which is often public, to pre-create that bucket. The victim’s model artifacts would then upload into the attacker-controlled bucket, where they could be swapped for a malicious pickle or joblib file. When Vertex AI later loaded the model, attacker code ran inside Google’s serving infrastructure. Unit 42 measured about 2.5 seconds between upload and read, and showed a proof of concept that replaced the file in 1.4 seconds and stole an OAuth token from the metadata server.
Microsoft Copilot SearchLeak: One-Click Data Theft from Enterprise Search
Microsoft patched CVE-2026-42824 after Varonis Threat Labs demonstrated the SearchLeak proof of concept against Microsoft 365 Copilot Enterprise Search. The chain used a crafted Microsoft 365 search URL, Copilot’s retrieval process, raw HTML handling, and Bing image fetches to steer Copilot toward sensitive items the signed-in user could already access. That included mailbox content, two-factor authentication codes, passwords, calendar events, and files in SharePoint and OneDrive. There was no public evidence of active exploitation at disclosure, but the exposure showed how AI assistants inherit broad access from existing Microsoft 365 permissions instead of defining new security boundaries. Copilot became a high-speed, natural-language interface into every indexed store available to a user, turning minor misconfigurations or overly generous group access into a clear path for Copilot data theft without needing phishing or new credentials. Tenant scoping and regular access reviews are now essential mitigation steps.
From Isolated Bugs to Systemic Enterprise AI Vulnerabilities
Taken together, these incidents show systemic enterprise AI vulnerabilities rather than isolated bugs. LiteLLM’s command injection, Vertex AI bucket squatting, and Copilot’s SearchLeak chain all exploit missing guardrails around powerful AI-facing services. In each case, the platform either trusted network reachability, assumed resource ownership, or inherited user access without adding finer-grained policy. The pattern is clear: AI components are often wired into the most sensitive systems but lack scoped access controls, per-connector entitlements, and complete audit logs of model and agent actions. To close this gap, enterprises need to treat AI agents and gateways as service accounts with explicit governance: rotate credentials frequently, restrict network access to MCP-style endpoints, and enforce per-tool authorization policies. Comprehensive logging of prompts, tool calls, and downstream data access is no longer optional; it is the only way to detect malware injection, lateral movement, and silent exfiltration through AI pipelines.
