Menu
SUBSCRIBE
SUBSCRIBE
Menu

Enterprise Security

Pink and orange brain-and-gear symbol illustrating Microsoft research on AI infrastructure attacks.

Attackers Target AI Infrastructure to Steal Credentials

, , , , , , , , , , , ,

Microsoft documented compromises of three software platforms, LiteLLM, RAGFlow, and Kestra, that also gave attackers lasting access and hijacked computing power.

Key takeaways

  • Microsoft documented real attacks on installations of LiteLLM, RAGFlow, and Kestra, three software platforms used to operate AI and other business systems.
  • Attackers entered through exposed or vulnerable software. They attacked the infrastructure surrounding AI models, not the models themselves.
  • The attackers stole AI provider credentials, maintained access to compromised systems, and used company computing power to mine cryptocurrency.
  • Microsoft said AI infrastructure should receive the same security protections as other critical company systems.
  • The research did not identify the affected organizations, the attackers, or how widespread these attacks have become.

Microsoft Security Research documented attacks against three AI infrastructure systems that allowed attackers to steal credentials, maintain access, and use company computing resources for cryptocurrency mining.

The AI infrastructure attacks involved LiteLLM, RAGFlow, and Kestra. These systems perform different jobs, but each can connect AI models with company applications, stored information, credentials, and computing resources.

That access made the systems valuable targets. Microsoft said attackers used different entry points but repeatedly pursued credentials, lasting access, data, and computing power.

Microsoft did not identify the affected organizations or the attackers. Its research describes three investigations and does not establish how common such attacks have become.

LiteLLM attackers stole keys and database records

LiteLLM serves as a gateway between company applications and AI model providers. It can hold API keys, which are secret codes that authorize access to services from companies such as OpenAI, Anthropic, and Microsoft.

Microsoft said attackers likely entered through security weaknesses in an internet-accessible LiteLLM gateway. They searched the system for AI provider keys, passwords, database connection details, and other credentials.

The attackers then used a stolen database connection to access records containing AI model settings and additional keys. Microsoft also observed attempts to send the stolen information to attacker-controlled systems.

The attack went beyond credential theft. The attackers installed cryptocurrency-mining software, added an SSH key that could provide continued access, and created processes intended to survive system restarts and resist removal.

RAGFlow attack intercepted new AI credentials

RAGFlow helps AI systems search and use information stored in documents. It also stores the credentials needed to connect with AI model providers.

In the case Microsoft investigated, attackers changed the RAGFlow application to capture newly entered AI provider credentials and send them outside the organization. The malicious code was connected to the application’s startup process, allowing it to load again when the service restarted.

Microsoft said it could not determine which security weakness enabled the attackers to run code inside RAGFlow. It identified several publicly reported weaknesses that could provide context but did not attribute the attack to any one of them.

Microsoft did not observe cryptocurrency mining or an interactive remote connection in this case. The attack primarily targeted credentials entered after the malicious code was installed.

Kestra attackers hijacked computing power

Kestra lets organizations automate tasks across software and computing systems. Microsoft said attackers likely exploited a security weakness that allowed them to bypass its login protections and create a malicious automated task.

That task allowed the attackers to run commands, inspect information held by connected software containers (isolated environments used to run applications), and collect credentials and other data.

The attackers also installed XMRig, software used to mine the Monero cryptocurrency. This allowed them to consume the organization’s computing power for their own profit.

Microsoft observed later activity that collected additional system information and stored it through Kestra’s own data-storage feature.

Microsoft urges tighter controls

Microsoft recommended that organizations prevent AI management tools from being directly accessible through the internet and install security updates promptly.

The company also recommended issuing separate AI service keys to individual teams, limiting how much each key can spend, and storing master credentials outside the applications that use them. Organizations should replace credentials associated with an exposed system.

Microsoft said organizations should limit what AI infrastructure can access and monitor it for signs of unauthorized activity.

Three red, blue, and green shields connected by data streams represent Microsoft Project Perception cyber agents.

Microsoft Expands AI Security Push With Project Perception

, , , , , , , , , , , ,

Microsoft says its new cyber model helped the MDASH vulnerability-testing system score 95.95% on CyberGym while reducing operating costs by nearly 50%.

 

Microsoft will open Project Perception to public preview on Aug. 3, expanding its AI security offerings with coordinated agents that can identify weaknesses, investigate threats and make security fixes across a company’s systems.

The company also introduced MAI-Cyber-1-Flash, its first cybersecurity-specific AI model. Microsoft says adding the model to MDASH, its system for finding and fixing software vulnerabilities, helped the full system score 95.95% on CyberGym while reducing operating costs by nearly 50% compared with its current configuration.

The launch moves Microsoft beyond Security Copilot, which assists security teams through a chat interface. Project Perception’s agents can act across Microsoft security products, although the company says people will retain control over high-impact decisions.

Three teams of AI agents

Project Perception coordinates three types of agents.

Red agents look for possible ways an attacker could compromise a system. Blue agents investigate activity and decide which threats present meaningful risks. Green agents make corrections and strengthen protections.

The agents share information as they work, allowing a weakness identified by one agent to move through investigation and correction steps without requiring a person to transfer it between separate tools.

At launch, Project Perception will bring this coordinated system into Microsoft Defender. Microsoft said it plans to extend the system across additional security products over time.

Microsoft pairs its model with OpenAI

The 95.95% CyberGym result does not measure MAI-Cyber-1-Flash by itself. The score is for MDASH, which paired Microsoft’s MAI-Cyber-1-Flash with OpenAI’s GPT-5.4.

Microsoft said MAI-Cyber-1-Flash can handle up to 90% of the work, while MDASH sends the hardest 10% to the larger, more expensive OpenAI model. The company attributes its cost reduction to that division of work.

CyberGym tests whether AI systems can work through software vulnerabilities. In Microsoft’s benchmark chart, the combined MDASH system scored 95.95%, compared with 83.6% for GPT-5.6 Sol and 83.8% for Mythos 5.

Those are Microsoft’s own test results, and the chart compares different combinations of models and AI agents. It does not specify how the products would perform across all cybersecurity tasks.

AI security competition grows

Microsoft is expanding its security portfolio as other major AI companies introduce systems that find and correct software weaknesses.

Google recently added Gemini 3.5 Flash Cyber to its CodeMender security agent. OpenAI offers Codex Security and its broader Daybreak cyber program. Anthropic has introduced Claude Security and Project Glasswing.

Human approval for high-impact actions

Giving AI agents the ability to make security changes also poses the risk that an incorrect decision could disrupt systems or unnecessarily alter protections.

Microsoft says customers will set the agents’ objectives and limits, including what information and systems they may access. Every high-impact action will require human approval.

The company also says MDASH keeps activity isolated between customers, records actions for review, and runs model testing in protected environments without internet access.

 

Project Perception enters public preview on Aug. 3. Microsoft has not said when it will become generally available.

Robot icon above an AI search bar on a dark digital interface, illustrating AI as the top driver of data security decisions.

AI Becomes the Top Driver of Enterprise Data Security Decisions

, , , , , , , , , ,

Organizations now rank protecting AI systems and the data they use ahead of preventing traditional data leaks when choosing data security tools.

 

Key Takeaways

  • 64.4% of respondents said protecting the data used by AI systems is their top reason for evaluating data security tools, surpassing the prevention of the unauthorized removal of sensitive data (56%).
  • Better visibility into the data used by AI systems ranked as the most important capability in a data security posture management (DSPM) platform at 57.8%.
  • Respondents identified moving data to train AI systems as the leading reason sensitive information ends up in unauthorized locations (40.9%).
  • 76.4% of respondents expressed concern about prompt injection attacks targeting AI systems.

Enterprise security priorities are shifting as organizations expand their use of AI, according to the report Leveraging DSPM and Artificial Intelligence to Solve Data Security Challenges from Enterprise Management Associates (EMA). The research found that organizations now prioritize protecting AI systems over preventing traditional data leaks when choosing data security tools.

The report surveyed 225 IT professionals, security practitioners, data governance leaders, and technology executives across North American enterprises about their approaches to protecting sensitive data in AI-enabled environments. Much of the research focuses on DSPM: software that helps organizations discover, classify, and protect sensitive data across cloud and on-premises environments.

AI becomes the top security priority

The survey found that 64.4% of respondents ranked protecting the data used by AI systems, including prompts and training data, as their top priority when evaluating data security tools. That surpassed preventing traditional data leaks at 56%. According to EMA, it is the first time an AI-related priority has become the leading reason organizations evaluate such security tools.

The shift reflects the capabilities organizations value most. Better visibility into the data used by AI systems and the responses they generate ranked first at 57.8%. It finished ahead of more traditional capabilities such as automatically identifying sensitive data, tracking where data moves, and discovering where sensitive data is stored.

AI training creates new data security risks

The report found that AI is also changing how sensitive data moves through organizations. 40.9% of respondents identified moving data to train AI systems as the leading reason sensitive information ends up in unauthorized locations. That exceeded developer testing environments (25.8%) and backup or replication errors (16%).

AI threats continue to grow

Security leaders also reported growing concern about threats targeting AI systems. More than three-quarters of respondents expressed concern about prompt injection attacks targeting AI systems. In addition, 57.8% said emerging AI regulations are driving stronger AI governance efforts, placing them ahead of established compliance frameworks such as the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act.

Governance still trails AI adoption

While organizations are investing in security features designed for AI systems, governance has not advanced at the same pace. Only 37.3% of respondents said their organizations have a fully implemented AI governance framework, while 56.4% reported their frameworks are only partially implemented. Several other surveys fielded in 2026 report similar findings relating to this “governance gap.”

Abstract digital visualization of multiple translucent data panels with warning and alert icons flowing toward a glowing blue security shield with a checkmark, representing frontier AI's autonomous cyber threat capabilities

Frontier AI Can Now Execute Autonomous Cyberattacks. The Pace Is Accelerating.

, , , , , , , , , , , , ,

The UK’s AI Security Institute (AISI) says Frontier AI cyber capability is advancing fast enough to pose tangible risks now, and that organizations have a shrinking window to build resilience.

 

Key Takeaways

  • Frontier AI models can now autonomously execute cyberattacks against enterprise networks without human direction. Anthropic’s Mythos completed both of AISI’s simulated network attack exercises, including “Cooling Tower,” which no prior model had ever solved.
  • Autonomous cyber capability has doubled every 4.7 months since late 2024; Claude Mythos Preview and GPT-5.5 significantly exceeded that rate. 
  • Defenders and attackers have access to the same tools. Cyber defenders already report significant advances in vulnerability discovery using recent models.
  • AISI warns that cyber attackers will soon gain access to the same frontier AI models that are currently limited to a small pool of large tech companies, government organizations, and cyber experts. The time for organizations to invest in strong security is now.

AISI published new data confirming that frontier AI models can autonomously complete cyberattacks against enterprise networks. The rate at which those capabilities are improving is accelerating.

This is not a theoretical risk. AISI’s most recent testing found that Mythos successfully completed autonomous attacks against two simulated enterprise networks in the majority of attempts. One of those networks, “Cooling Tower,” had never been solved by any prior model.

AISI measures this progress using “time horizon” benchmarks: the time it takes a frontier model to reliably complete a task on its own, compared to how long the same task would take a human cyber expert. Since late 2024, that capability has been doubling every 4.7 months, itself an acceleration from the 8-month doubling time AISI reported in November 2025. Two recent models, Claude Mythos Preview and GPT-5.5, substantially exceeded even that faster trend.

Currently, access to Mythos and GPT-5.5 is gated. Anthropic granted access to only a few dozen organizations, including big tech companies, cybersecurity firms, and U.S. and allied government organizations. OpenAI limits access to GPT-5.5 through its Trusted Access For Cyber program, vetting users to ensure security. Over time, cybercriminals will find ways to access these tools and exploit cyber vulnerabilities. AISI stresses the time to implement strong security governance is now. 

AISI is developing tougher evaluation tools, including new cyber ranges with active defenses, to keep pace with model progress. The UK’s National Cyber Security Centre (NCSC) has published guidance on using AI models to find vulnerabilities.