Menu
SUBSCRIBE
SUBSCRIBE
Menu

Cyberattacks

Pink and orange brain-and-gear symbol illustrating Microsoft research on AI infrastructure attacks.

Attackers Target AI Infrastructure to Steal Credentials

, , , , , , , , , , , ,

Microsoft documented compromises of three software platforms, LiteLLM, RAGFlow, and Kestra, that also gave attackers lasting access and hijacked computing power.

Key takeaways

  • Microsoft documented real attacks on installations of LiteLLM, RAGFlow, and Kestra, three software platforms used to operate AI and other business systems.
  • Attackers entered through exposed or vulnerable software. They attacked the infrastructure surrounding AI models, not the models themselves.
  • The attackers stole AI provider credentials, maintained access to compromised systems, and used company computing power to mine cryptocurrency.
  • Microsoft said AI infrastructure should receive the same security protections as other critical company systems.
  • The research did not identify the affected organizations, the attackers, or how widespread these attacks have become.

Microsoft Security Research documented attacks against three AI infrastructure systems that allowed attackers to steal credentials, maintain access, and use company computing resources for cryptocurrency mining.

The AI infrastructure attacks involved LiteLLM, RAGFlow, and Kestra. These systems perform different jobs, but each can connect AI models with company applications, stored information, credentials, and computing resources.

That access made the systems valuable targets. Microsoft said attackers used different entry points but repeatedly pursued credentials, lasting access, data, and computing power.

Microsoft did not identify the affected organizations or the attackers. Its research describes three investigations and does not establish how common such attacks have become.

LiteLLM attackers stole keys and database records

LiteLLM serves as a gateway between company applications and AI model providers. It can hold API keys, which are secret codes that authorize access to services from companies such as OpenAI, Anthropic, and Microsoft.

Microsoft said attackers likely entered through security weaknesses in an internet-accessible LiteLLM gateway. They searched the system for AI provider keys, passwords, database connection details, and other credentials.

The attackers then used a stolen database connection to access records containing AI model settings and additional keys. Microsoft also observed attempts to send the stolen information to attacker-controlled systems.

The attack went beyond credential theft. The attackers installed cryptocurrency-mining software, added an SSH key that could provide continued access, and created processes intended to survive system restarts and resist removal.

RAGFlow attack intercepted new AI credentials

RAGFlow helps AI systems search and use information stored in documents. It also stores the credentials needed to connect with AI model providers.

In the case Microsoft investigated, attackers changed the RAGFlow application to capture newly entered AI provider credentials and send them outside the organization. The malicious code was connected to the application’s startup process, allowing it to load again when the service restarted.

Microsoft said it could not determine which security weakness enabled the attackers to run code inside RAGFlow. It identified several publicly reported weaknesses that could provide context but did not attribute the attack to any one of them.

Microsoft did not observe cryptocurrency mining or an interactive remote connection in this case. The attack primarily targeted credentials entered after the malicious code was installed.

Kestra attackers hijacked computing power

Kestra lets organizations automate tasks across software and computing systems. Microsoft said attackers likely exploited a security weakness that allowed them to bypass its login protections and create a malicious automated task.

That task allowed the attackers to run commands, inspect information held by connected software containers (isolated environments used to run applications), and collect credentials and other data.

The attackers also installed XMRig, software used to mine the Monero cryptocurrency. This allowed them to consume the organization’s computing power for their own profit.

Microsoft observed later activity that collected additional system information and stored it through Kestra’s own data-storage feature.

Microsoft urges tighter controls

Microsoft recommended that organizations prevent AI management tools from being directly accessible through the internet and install security updates promptly.

The company also recommended issuing separate AI service keys to individual teams, limiting how much each key can spend, and storing master credentials outside the applications that use them. Organizations should replace credentials associated with an exposed system.

Microsoft said organizations should limit what AI infrastructure can access and monitor it for signs of unauthorized activity.

Abstract blue AI eye representing AI use in cybersecurity and rising reliability problems

AI Use in Cybersecurity Jumps To 78% As Detection And Response Problems Rise

, , , , , , , , ,

SANS found that AI adoption climbed from 50% to 78% in one year, while the share of practitioners reporting significant shortcomings increased from 45% to 63%.

 

Key Takeaways

  • AI use in cybersecurity strategies rose from 50% in 2025 to 78% in 2026, the largest year-over-year increase recorded in the SANS survey.
  • In 2026, 63% of practitioners, the IT and security professionals executing cybersecurity initiatives,  reported problems with AI threat detection and response, up from 45% a year earlier. False positives, difficulty recognizing new threats, and confidently wrong output were among the most common problems.
  • Security teams now have more responsibility for governing AI, but the systems supporting that work have barely changed. 50% of senior security leaders said their organization has a formal AI risk program, compared with 36% of practitioners.

The 2026 SANS AI Survey found that AI use in cybersecurity increased sharply even as more practitioners reported problems with the technology’s ability to detect and respond to threats.

The cybersecurity training and research organization reported that 78% of surveyed practitioners said their employer actively uses AI as part of its cybersecurity strategy, up from 50% in 2025. At the same time, 63% reported significant shortcomings when AI was used to detect or respond to threats, compared with 45% a year earlier.

AI is not yet central to security operations 

Among respondents, 54% described AI as being in early production or at the pilot stage, with only 11% considering it critical to their security work. Another 27% said it had been integrated into daily operations.

 

AI use in cybersecurity outpaces reliability

Nearly two-thirds of practitioners said an AI security tool had sent their team in the wrong direction at least once in the previous 12 months. The report found that 23% experienced this between one and five times, while 42% reported six or more instances.

These AI cybersecurity failures can add work for human analysts who must check the system’s conclusions. The survey found that 73% of practitioners said AI had changed their team’s training requirements, up from 51% in 2025. Human review was also among the controls respondents considered most effective against AI-related attacks.

Security teams are taking on more responsibility for governing AI, but formal programs have barely grown. The share of practitioners whose teams have an AI governance role rose from 68% to 76%, while the share reporting a formal AI risk program increased only from 35% to 36%.

AI use also remains outside formal company rules in many workplaces. Only 41% of respondents said generative AI was used for security tasks under a strict policy, while 39% reported informal use without a policy.

Senior executives viewed their companies as further along. 50% said their company had a formal AI risk program, compared with 36% of practitioners. The report said the difference may reflect programs that have not trickled down to practitioners or different understandings of what counts as a formal program.

The practical gaps were also visible in the survey. 63% of practitioners said their security teams could not clearly track where AI systems were being used or what company data those systems might expose. Another 54% said their company had no established standards for auditing AI systems.

Attackers’ use of AI added another source of pressure. 95% of respondents said attackers were already using AI, with 78% of organizations reporting confirmed or suspected AI-related attacks in the past year.

Recent surveys from Kroll and Netwrix have also found similar governance gaps.

The survey fielded responses from 536 IT and cybersecurity professionals worldwide. A separate survey was completed by 57 chief information security officers and other senior security executives. It included respondents from the technology, cybersecurity, banking, finance, and government sectors.

Abstract Earth from space with a digital AI overlay illustrating a Five Eyes warning about frontier AI cyber risks.

Five Eyes Warn Frontier AI Could Enable Major Cyberattacks Within Months

, , , , , , , , , , ,

The cyber agencies of Australia, Canada, New Zealand, the United Kingdom and the United States said advances in frontier AI may soon increase the speed, scale and sophistication of cyber operations.

The cybersecurity and intelligence agencies of the Five Eyes alliance issued a rare joint statement, warning that frontier AI advances could enable more serious cyberattacks within months, potentially altering the threat landscape faster than many organizations expect.

The statement was released by the leading cyber agencies of Australia, Canada, New Zealand, the United Kingdom and the United States, including organizations such as the U.S. National Security Agency (NSA), the Cybersecurity and Infrastructure Security Agency (CISA), the United Kingdom’s National Cyber Security Centre (NCSC), the Australian Cyber Security Centre (ACSC), and the Canadian Centre for Cyber Security (CCCS).

According to the agencies, increasingly capable AI models could enable threat actors to conduct cyber operations with greater speed, scale, and sophistication. The agencies warned that advances in frontier AI may reduce the expertise and resources traditionally required to carry out complex cyber activities, potentially placing more powerful capabilities into the hands of a broader range of threat actors.

The Five Eyes called on organizations to take practical steps now to understand their risks, strengthen cybersecurity fundamentals, and ensure leadership is prepared to respond as threats evolve.

The statement also emphasized that responding to AI-enabled cyber risks cannot be treated solely as a technology challenge. The agencies said a “whole-of-organization and whole-of-society response is required,” with leaders across business, government, and critical infrastructure working together to improve resilience.

For organizational leaders, the agencies highlighted several priority actions. Here they are verbatim:

  • Reduce your attack surface: Limit unnecessary system access and external connectivity. Challenge whether systems need to be exposed at all and isolate those that do not.
  • Accelerate patching processes: AI is shortening the time between vulnerability discovery and exploitation. Delays in patching increase risk, especially for operational systems with long update cycles. Prioritize security updates accordingly to manage risks.
  • Address legacy systems: Unsupported systems are easy targets. They are not just technical debt; they are strategic liabilities.
  • Review and strengthen identity and access controls: Limit who can access critical systems. Enforce strong authentication and regularly review permissions.
  • Prepare for incidents before they happen: Test response plans, train and prepare teams, and assume breaches will occur. Focus on fast containment and recovery.

The agencies also encouraged organizations to use AI as part of their defensive strategy, noting that the technology can help improve threat detection, accelerate incident response, and strengthen overall cyber resilience when deployed responsibly.

The Five Eyes agencies concluded by calling on leaders to act now rather than wait for future guidance or major incidents. Their message was that organizations should build resilience before more capable AI systems further compress the timeline between identifying a vulnerability and exploiting it.