Topic starter
26/08/2026 11:51 am
TL;DR: A July 2026 Darktrace disclosure shows an exposed LiteLLM AI gateway with standing Amazon Bedrock access turned one server compromise into a far wider identity risk, according to Cakewalk's analysis. The core issue is not the gateway category itself but whether it holds persistent credentials, because runtime policy at the gateway can either collapse or concentrate blast radius.
Editorial analysis by NHI Mgmt Group, based on content published by Cakewalk: “AI Gateway Security: The New Attack Surface and the New Control Point”.
Key questions
Q: What breaks when AI agents keep standing credentials?
A: The access model breaks because the agent can continue acting after the human has moved on, the workflow has shifted, or the original approval is no longer relevant.
Q: Why do AI gateways need runtime policy instead of static access rules?
A: Static rules cannot reflect the short-lived, context-sensitive nature of agent requests.
Q: How do teams know whether a gateway is really reducing blast radius?
A: A gateway is reducing blast radius only if compromise leaves little or nothing reusable behind.
Practitioner guidance
- Remove standing credentials from gateway hosts Ensure the gateway does not retain reusable cloud, model or downstream application credentials on the server itself.
- Enforce per-call policy decisions Require a policy decision for every agent or application request before access is granted, with no fail-open path if the policy engine is unavailable.
- Separate model access from task governance Map which controls protect model-provider connectivity and which controls govern agent actions inside applications.
Bottom line: The article shows that AI gateway compromise becomes far more serious when the gateway holds standing access, because the host then carries reusable privilege into the breach.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
26/08/2026 11:51 am
Persistent access at the gateway was the real failure, not the gateway pattern itself: The source incident shows why the control question is whether the gateway holds credentials that survive a single request. When a gateway keeps standing access, one host compromise can become model access, cloud access and downstream identity exposure. Practitioners should judge gateway design by what remains usable after compromise, not by whether policy exists in front of the request.
A few things that frame the scale:
- AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: Should organisations treat AI governance and AI security as the same thing?
A: No. Governance answers who approved the system, what data it may use, and which policy applies. Security answers whether an attacker can misuse the system, steal data, or abuse credentials. The two functions need different owners, different evidence, and different response workflows.
👉 Read our full editorial: AI gateway security redefines the control point for agent access