AI Gateway Security: The New Attack Surface and the New Control Point

1The Breached AI Gateway Held Standing Access

In July 2026, Darktrace disclosed a break-in at one of its customers. An attacker had installed a cryptominer on one of the company's servers, which is what Darktrace's monitoring caught. That server was the company's own AI gatewayGlossaryAI GatewayAn AI gateway is one server that every application in a company sends its model calls through. It holds the model-provider credentials, routes each…, a LiteLLM gateway wired to Amazon Bedrock.[1]

LiteLLM is an AI gateway, open-source software that routes an application's calls to language models. Every model call the company made went through this gateway. Its SSH port was open to the entire internet. Darktrace recorded a large number of login attempts against it, almost all from a single address, which is what an automated password-guessing attack looks like. Darktrace could not confirm how the attacker finally got in.

What made it worth taking was what the AI gateway carried. The AI gateway held standing access to Amazon Bedrock through an instance profile, which attaches AWS permissions to the server itself. Anything running on that server could call Bedrock without a password or a key file. The AI gateway also checked nothing about who was calling, because its job was to forward requests. One exposed login was therefore worth everything behind it.

The mining was the only damage Darktrace confirmed. The attacker also tried to invoke Bedrock models and to create new AWS users, though Darktrace found no evidence that either succeeded. The access they held was worth far more than the compute they took.

A compromise may provide attackers with access not only to compute resources, but also to cloud identities, model services, sensitive prompts, and other connected systems.

Darktrace

The LiteLLM AI gateway was worth taking because a gateway concentrates access by design. The same concentration makes a gateway the one place where every call can be governed. What a break-in is worth comes down to what the gateway was built to hold.

2The Same Gateway Shape Is Going Mainstream

The largest cloud and identity platforms are converging on a single gateway for every agent call. They committed to the architecture before deciding what that gateway is allowed to hold.

Google's Gemini Enterprise Agent Platform places an Agent Gateway between agents and everything they access, with policy evaluated at the gateway.[2] Amazon Bedrock's AgentCore works the same way, with a policy layer that checks each call before it reaches the app.[3] Cloudflare routes agent traffic through Model Context ProtocolGlossaryMCP (Model Context Protocol)The Model Context Protocol (MCP) is an open standard, originally released by Anthropic in late 2024, that defines how AI agents connect to external… (MCP) server portals that attach the credential and proxy the request on the agent's behalf[4] while Okta has opened its own Agent Gateway to customers as a research release.[5]

The convergence is correct: enforcing one policy across every agent action requires one place to enforce it, because the alternative scatters policy app-by-app until nobody can audit it. When every credential and every call runs through one gateway, it holds more access than any employee, service accountGlossaryService AccountA service account is a non-human identity used by applications, services, or automated processes to authenticate and interact with other systems.… or app in the company. Each new gateway also adds another single point of failure.

All four have committed to enforcement at the gateway, though what it keeps between calls is still an open question. Cakewalk answers it with zero standing accessGlossaryZero Standing PermissionsZero standing permissions (ZSP) is a security model in which no user, agent or system holds persistent privileged access. Access is authorized….

3A Governed Gateway Holds No Standing Access

Where the LiteLLM AI gateway carried model traffic, Cakewalk's MCP Gateway governs agent accessOpinionHuman → Agent → System: A Working Model for Governing Agent AccessHow a line on our 2023 roadmap became security’s biggest unsolved problem and led to the access layer we are now building. to apps. The same risk reaches both, because it follows from concentrating access in one place rather than from any one product category.

An agent on Cakewalk never holds a credential of its own. It starts every call with nothing it can use and gets no blanket grant it could carry into the next one. Every tool call is evaluated fresh against policy before it runs and resolves to one of three outcomes: auto-approve, escalate to a human or deny. When a call escalates, the session suspends mid-task and waits. The approval request appears inline in the agent client through elicitation, a method the MCP specExternal Link Tohttps://modelcontextprotocol.io/specification/2026-07-28 defines and goes to the person the agent acts for. It resumes only if they approve. A refusal denies the call, as does silence: an unanswered request dies after five minutes and is logged as a timeout.

Every agent action lands in one of four types: read, write, destructive or external. The tool's vendor declares the MCP annotations and Cakewalk maps them onto those four types. A tool that declares none is treated as destructive, which the default policies deny until an admin classifies it. The type sets the default outcome. Reads are auto-approved, writes wait for human approval and destructive or external actions are denied outright. An admin can change any of those defaults and can add custom policies that outrank them.

Policies always produce a decision as the four defaults cover every action type and cannot be removed. If the engine itself is unreachable, the gateway denies rather than waving the call through. There is no fail-open path. The engine is Open Policy AgentGlossaryOPA / RegoOpen Policy Agent (OPA) is a CNCF-graduated policy engine that decouples policy decision-making from application logic. Rego is OPA's purpose-built… (OPA), with policies expressed in its Rego language. Admins configure those policies in the Cakewalk policy builder while Rego runs underneath. Security teams already run OPA in front of Kubernetes and service traffic. In the gateway it evaluates every tool call before anything moves upstream. The evaluation is deterministic, which means the same call in the same context yields the same outcome every time. Runtime Governance: The Missing Layer for Agent AccessKnowledgeRuntime Governance: The Missing Layer for Agent AccessFive industry responses are shaping agent identity and authentication. None governs what agents do at runtime. This article maps the gap and the four… walks through that decision flow in full, including why no language model sits anywhere in it.

The approval flow has one exception. It arises when an agent client does not yet support elicitation and so cannot show the approval prompt. The gateway then denies any call that requires approval, unless an admin deliberately opts to auto-approve those calls instead.

An agent never receives a real credential. The gateway resolves the token on the server side and injects it into the outbound request without ever showing it to the agent or the model. A prompt-injectedGlossaryPrompt InjectionPrompt injection is an attack in which adversarial input manipulates an AI agent into performing unintended actions. The attacker embeds instructions… agent cannot leak a token it never held. The credential itself is stored with envelope encryption, encrypted under AES-256-GCM with its own data key wrapped by an external key management service. One broken key exposes at most one credential. Cakewalk made that trade deliberately: the gateway persists the credential so the agent side holds nothing.

Every call the gateway allows produces one permanent audit event: who acted, what they did, against which connection, which policy fired and its outcome, with a timestamp. Each action traces to a named person. An agent inherits only what that person may use, which the gateway verifies on every call. Revoking their access denies the agents acting for them at the next call. The record also feeds forward, which is why a company can replay the last 30 days of recorded calls against a policy change and see which past decisions would flip before the change goes live.

A governed gateway is not unbreakable. It has to assume an attacker can get in. What changes is what that attacker walks away with. An attacker who breaks in the same wayNewsAn AI Agent Ran a Ransomware Attack on Its OwnJadePuffer is what the security firm Sysdig calls the first ransomware attack run start to finish by an AI agent, with no human directing it. The… finds no standing access to inherit, no agent-usable credential to steal and every action still gated and recorded. Even in the worst case, the one Darktrace described, a break-in here is worth a fraction of what it was worth there.

4Concentration Becomes Control

Putting agent access in one place creates a target. Every control point does, which is why concentration itself is not the problem. What that target is worth to an attacker who seizes it is a design choice. The same concentration that made the LiteLLM AI gateway worth attacking is what makes a governed gateway the one place to govern. Governing here covers what the agent does in the company's apps. What it does inside its own runtime stays outside the gateway's view. Those app calls are where a break-in turns into damage.

That is why Cakewalk builds at the gateway rather than app by app, where enforcement waits on every app to ship its own hooks and only ever covers the ones that did. A gateway that holds nothing standing, checks every governed call as it happens and records the result turns that concentration into control. The position that could have opened everything up becomes the control point agent access has been missing.