Microsoft's own incident data says the AI gateway is now the credential store

A model gateway is a credential concentrator by design. Sitting in proxy position, LiteLLM may hold model-provider keys, its own master key, virtual-key records, database connection strings, routing configuration and tenant policy data ^[6]. Microsoft puts the execution origin for the observed activity in the gateway process itself, and assesses with high confidence that access came through the exposed gateway surface ^[7].

That pairing removes the step most detection logic is built around. There is no move to a secrets store and no escalation to a privileged account, because the material is already in the environment of the process the attacker is executing inside ^[14]. Whoever gets command execution in that container gets the whole secret set on the first try.

The route to that execution is where patch queues get tested. The command primitive, CVE-2026-42271, is an authenticated command-execution issue in LiteLLM's MCP stdio test endpoints ^[8]. The publicly described chain that makes it reachable without credentials adds CVE-2026-48710, a host-header validation bypass in Starlette ^[9]. One of those two advisories arrives under the name of the AI product a team knows it runs; the other does not ^[15]. A patch process scoped to the product covers half the chain and reports itself green.

Microsoft's defender guidance is to inventory exposed AI management surfaces, restrict administrative access, and monitor for gateway-originated execution and secret access ^[5]. That is the checklist written for domain controllers and jump hosts, and it works for the same reason: these are systems whose compromise is a credential event rather than a host event ^[1]. The obstacle is ownership. The exposed assets Microsoft lists across the three cases run past provider keys to proxy-issued virtual keys, tenant configuration, workflow execution and host compute, with post-compromise behaviour varying by what the workload was for ^[10]. If those surfaces are absent from the asset inventory, the patch SLA that applies to them is whatever the deploying team had time for, and the privilege scoping is whatever the quickstart guide used.

Worth noting what did not appear. The objectives Microsoft describes are credential theft, persistence and compute monetisation: the standing goals of commodity intrusion crews, not model-specific abuse of the kind that dominates AI security research agendas ^[16]. Stage two of the LiteLLM case moved from gateway-level command execution to payload delivery and masqueraded execution, launched from the compromised gateway ^[11]. That is a hosting decision, not an AI one.

Which is the argument for dropping the research exemption. Nothing in these three cases needed novel defences. It needed the AI stack to be on the list of things that get inventoried, patched to a deadline, and scoped so that one process does not hold every key in the estate.