AI Infrastructure and the Evolving Attack Surface

As organizations deploy generative AI into production environments, a new layer of infrastructure has emerged inside enterprise cloud environments: AI gateways.

What is an AI gateway?

AI gateways are systems that sit between users, applications, and foundation models, often holding privileged cloud permissions and managing access to AI services at scale.

Because of that role, AI gateways are becoming an increasingly important part of the enterprise attack surface. A compromise may provide attackers with access not only to compute resources, but also to cloud identities, model services, sensitive prompts, and other connected systems.

This blog examines how Darktrace investigated a compromised AI gateway connected to Amazon Bedrock services that was subsequently observed communicating with cryptomining infrastructure. Based on its configuration and associated Identity and Access Management (IAM) role, the instance appeared to function as a gateway to Amazon Bedrock-hosted AI services. Following suspected compromise activity, the host was observed communicating repeatedly with known cryptomining infrastructure before subsequently being shut down. Darktrace detected and escalated the activity through its Enhanced Monitoring and Managed Threat Detection services.

While the ultimate impact in this case appeared to be unauthorized cryptomining, the incident is notable because of where it occurred. The compromised asset sat at the intersection of cloud infrastructure, identity, and AI services. Recent research has highlighted how AI gateways such as LiteLLM can become attractive targets due to their ability to centralize credentials, model access, and cloud permissions. Although Darktrace found no evidence linking this activity directly to publicly disclosed LiteLLM vulnerabilities, the incident demonstrates why organizations should treat AI infrastructure as part of their critical attack surface rather than as a standalone application tier [1].

Why cryptomining remains a common cloud post-compromise activity

Cryptomining can be a lucrative post-compromise activity in cloud environments. After gaining access to a cloud asset, attackers may deploy mining software to abuse the victim’s compute resources for financial gain. This type of activity is likely to be opportunistic, targeting exposed services, weak credentials, leaked access keys, vulnerable applications, or misconfigured cloud workloads.

A typical cloud cryptomining intrusion may involve:

• Identifying exposed or vulnerable cloud infrastructure
• Gaining access through exposed services, credentials, or application weaknesses
• Downloading and executing mining software
• Establishing repeated outbound connectivity to mining pool infrastructure
• Continuing to consume compute resources until the activity is detected and disrupted

The notable element in this case is not the cryptomining alone, but where it occurred: on cloud infrastructure supporting AI-related activity. This shows how assets used to enable AI services can still be exposed to familiar cloud compromise risks.

Investigating a compromised AI gateway connected to Amazon Bedrock

On June 12, 2026, Darktrace observed activity consistent with active cryptomining from an Amazon Web Service (AWS) EC2 instance named LiteLLM-Proxy. The instance appeared to support LiteLLM activity and was associated with an instance profile that had access to Amazon Bedrock resources.

AI gateways are designed to centralize access to large language models, often handling authentication, routing, logging, and policy enforcement for AI applications. From a security perspective, they also aggregate cloud permissions, model access, and application workflows into a single control point. As a result, compromise of an AI gateway can have implications beyond the affected host itself.

While the exact initial access vector could not be confirmed, the activity appears to follow a sequence often seen in compromises of internet-facing systems: brute-forced access, payload delivery, and repeated outbound connectivity to mining pool infrastructure.

Stage 1: Internet-exposed SSH enabled initial access

Prior to the observed cryptomining activity, the LiteLLM-Proxy EC2 instance appeared to be externally exposed over SSH, with port 22 open to 0.0.0.0/0.

Prior to the cryptomining activity, Darktrace observed a large volume of inbound connection attempts to the instance over port 22 from external IP addresses, predominantly from 145.241.123[.]102, suggesting brute-force activity [2]. Many of these connections were short-lived, lasting only a few seconds, indicating scanning or failed login attempts.

‍

The available telemetry did not confirm whether any inbound SSH connection resulted in successful authentication, preventing this activity from being confirmed as the initial access vector. However, the combination of public SSH exposure, inbound connections from external IP addresses, and subsequent miner activity suggests that SSH was a plausible access path.

Stage 2: XMRig malware downloaded to the AI gateway

Before the first observed connection to the mining pool, the EC2 instance downloaded 3.42 MB of data over an HTTP connection on port 80 to the external endpoint, 185.62.1[.]8, which appears to host a ZIP file containing XMRig crypto-mining malware [3][4]. As host-level logs were not available, Darktrace could not confirm how the miner was executed or whether the earlier SSH activity directly enabled payload delivery. However, the timing of the download, followed shortly by repeated mining pool connectivity, supported the assessment that the instance had been compromised and was being used for unauthorized compute activity.

Stage 3 – Compromised AI gateway communicates with cryptomining infrastructure

Just a few minutes later, Darktrace observed the LiteLLM-Proxy EC2 instance connecting to the hostname pool.hasvault[.]pro over HTTPs on port 443. Following the initial connection, repeated outbound connectivity to the same hostname was observed. This pattern is consistent with active cryptomining pool communication, where a compromised host communicates with mining infrastructure to receive work and submit results.

This activity triggered the Enhanced Monitoring model “Compromise / High Priority Crypto Currency Mining”, which was escalated to the customer by Darktrace’s SOC. The activity was also summarized by Darktrace’s Cyber AI Analyst, which grouped the relevant events into a single investigation narrative, helping to identify the repeated mining pool connectivity from the affected cloud asset.

The use of HTTPS over port 443 is notable because, when viewed in isolation, this traffic may not appear inherently suspicious. In this case, however, the destination, volume of connections, and lack of similar activity provided the behavioral context needed to identify the communication as suspicious.

Stage 4: Managed Threat Detection identifies active resource abuse

The cryptomining activity was received by Darktrace’s Managed Threat Detection service and reviewed by Darktrace’s SOC. Following review, the activity was escalated to the customer. This escalation provided the customer with timely notification of active resource abuse in the AWS environment.

Stage 5: Suspicious IAM activity suggests possible cloud credential misuse

Separately, on June 13, Darktrace observed suspicious activity originating from an additional IAM user.

First, the user was observed attempting the “GetSendQuota” event, an action that had not performed by the account within at least the previous three months. Additionally, the source IP address of this command appeared to be 14.176.1[.]47, geolocated in Vietnam, whereas activity for this user had mostly been seen from Amazon IP addresses. Furthermore, the AWS CLI was also observed being used for this activity, which was also unusual for the user. This was detected by the model “IaaS / Unusual Activity / Unusual AWS CLI Activity”.

Further suspicious activity was observed from the IAM user using the long-term access key. Notably, failed “InvokeModel” and “ListFoundationModels” commands were detected, suggesting attempted interaction with Amazon Bedrock services, including model enumeration or invocation. While this may suggest relation to the LiteLLM compromise observed the previous day, there is insufficient evidence to conclusively link the two events.

The attempted “CreateUser” command was also notable because the requested username appeared low-meaning, which may indicate an attempt to establish persistence by creating a new account. This activity triggered the model “IaaS / Admin / New AWS User Account Creation”.

Even without a confirmed link between the two incidents, the IAM activity remains significant. It demonstrates the importance of incorporating workload both telemetry and control-plane telemetry into cloud compromise investigations. While the EC2 cryptomining activity indicated compute resource abuse, the IAM activity suggested potential credential compromise or misuse involving long-term access keys, along with attempted cloud service abuse.

Key lessons for securing AI infrastructure

This incident was notable not because of the cryptomining activity itself, but because of where it occurred. The compromised system appeared to function as an AI gateway with access to Amazon Bedrock services, placing it at the intersection of cloud infrastructure, identity, and AI operations. As organizations deploy AI capabilities into production environments, these platforms are becoming part of the same attack surface that adversaries already target through exposed services, credential theft, and cloud misconfigurations.

While the exact intrusion path could not be confirmed, and no definitive link was established between the compromised workload and the suspicious IAM activity observed during the investigation, both events reinforce a broader reality: AI infrastructure must be secured as part of the wider cloud environment rather than treated as a separate technology stack.

In this case, the most obvious sign of compromise was communication with cryptomining infrastructure. The more important lesson is that Darktrace’s behavioral analysis revealed risk surrounding a privileged AI-enabled asset before the full scope of the incident was understood. As AI gateways increasingly concentrate cloud permissions, model access, and application workflows, defenders will need to focus less on individual alerts and more on understanding how behaviors connect across workloads, identities, and services.

Credit to Angel Arribas Lopez (Associate Principal Cyber Analyst), Nathaniel Jones (Field CISO/VP Threat Research), Emma Foulger (Global Threat Ops),  and Mark Turner (Security Researcher)

Edited by Ryan Traill (Content Manager)

Appendices

Darktrace Model Detections

·       Compromise / High Priority Crypto Currency Mining

·       Compromise / Monero Mining

·       Device / Internet Facing Device with High Priority Alert

·       IaaS / Unusual Activity / Unusual AWS CLI Activity

·       IaaS / Admin / New AWS User Account Creation

MITRE ATT&CK Mapping

Initial Access – External Remote Services – T1133

Initial Access – Valid Accounts – T1078

Execution – Command and Scripting Interpreter – T1059

Persistence – Create Account – T1136

Discovery – Cloud Service Discovery – T1526

Impact – Resource Hijacking – T1496

References

[1] https://docs.litellm.ai/blog/security-update-march-2026

[2] https://www.abuseipdb.com/check/145.241.123.102

[3] https://urlscan.io/search/#185.62.1.8

[4] https://www.virustotal.com/gui/file/85de36ff66fae9f4b059cbedf6d36e017ebc26c828f99f911a96e78636f21200/community

Why traditional cybersecurity approaches are not enough for AI

AI adoption outpaces most security programs’ ability to adapt.  That gap is now one of the most consequential sources of cyber risk facing enterprises. As organizations embed generative and agentic AI into development workflows, business operations, and security tooling itself, the question is no longer whether AI will introduce risk. The question is whether organizations understand where that risk actually lives and how to manage it operationally.  

Two recent pieces of guidance underscore this shift:

1. The upcoming Cybersecurity Framework Profile for AI from NIST

2. The Five Eyes government guidance on the careful adoption of agentic AI services

Taken together, they point to a critical conclusion. AI security cannot be reduced to model hardening or prompt filtering. It requires a defense in depth strategy that treats AI as both a new attack surface and a force multiplier for defense, while accounting for how AI fundamentally changes scale, speed, and autonomy.  

Recent threat research suggests that today's cyber risk is driven less by initial compromise and more by an adversary's ability to blend into normal operations over time. AI systems create the same exposure in a new form: more autonomy, more scale, and more opportunities for risky behavior to blend into normal operations.

How NIST defines the three core pillars of AI security

The NIST profile organizes AI risk across three inseparable focus areas that span all cybersecurity functions, Secure, Defend and Thwart. These areas are not sequential. They exist simultaneously and must be addressed together.

Secure

This treats AI as an attack surface. It includes models, prompts, agents, pipelines, training and inference data, retrieval augmented generation corpora, and the AI supply chain itself. AI systems are opaque, probabilistic, and non-deterministic by design. Some vulnerabilities are inherent in how models are trained or how data is sourced. Traditional patching does not fully mitigate these risks. This is also where many enterprises are weakest today and, critically, where many security programs stop.  

Defend

This is AI as a defensive force multiplier. AI can improve detection speed, scale, correlation, and response, but only if the right models are used and operationalized correctly. Machine-speed behavior-based detection, response and containment becomes critical in defending non-deterministic systems. Accuracy, explainability, governance, testing, validation, and integration into SOC workflows matter as much as capability. Without those controls, hallucination risk, over automation, and misplaced trust become security risks themselves.  

Thwart

This treats AI as an adversarial accelerant. Threat actors are already using AI to generate targeted social engineering attacks, deepfakes, malware, and autonomous attack agents. Asymmetric warfare is highlighting faster vulnerability discovery and exploitation with a lag on patch development, testing and deployment.  

How this looks in practice

Darktrace researchers observed scaled, automated exploitation of the React2Shell vulnerability within days of disclosure. A vulnerable cloud asset was exploited in under 120 seconds of being deployed. Darktrace research team observed an AI/LLM-generated malware sample used in exploitation activity tied to React2Shell. The significance isn't novelty. It is that AI lowers the barrier to producing usable offensive tooling and compresses the time between experimentation and deployment.  

Tactics are getting more and more creative in order to string together steps of an attack kill chain. This creates a dependency on behavior-based detection, autonomous investigation, autonomous containment, training, resilience investment, and recovery planning across the entire enterprise.

Why agentic AI fundamentally changes enterprise cyber risk

The Five Eyes guidance on agentic AI highlights material changes to the cyber risk profile of an organization. Unlike generative AI systems that produce content for human consumption, agentic AI systems reason, plan, and act autonomously across tools, data, and environments. That autonomy, combined with access to real systems, amplifies the impact of traditional cyber failures and introduces new system level risks that are difficult to predict, observe, and contain.  

Risk in agentic systems does not live in the model alone. It emerges from interactions between models, prompts, memory, tools, APIs, identities, privileges, inter-agent trust relationships, and human assumptions baked into design. Vulnerabilities are often introduced through data, connectors, natural language interfaces, protocols, and drift by design.

In supply-chain incidents, attackers did not need sophisticated exploits to scale impact. They abused trusted systems built for automation and implicit access. Agentic AI inherits that model. Once a system can act across tools, data, and workflows, compromise propagates through trust relationships that were never designed for machine autonomy.

The major agentic AI risk classes include the following:  

• The identity control for non-human identities or autonomous agents makes it difficult to mitigate over-permissioning, limiting access, scope, and duration, as well as access hygiene

• Agents are frequently over permissioned

• Compromised tools inherit agent authority

• Static secrets enable impersonation

• Implicit trust between agents enables lateral movement

Design and configuration risks compound this, including privileges evaluated once at startup, poor segmentation, unvetted third party tools, reused authorization decisions outside their original context, and guardrail limitations.  

Behavioral risk  

Agents can optimize for goals in unsafe ways, misinterpret ambiguous intent, chain actions into unintended sequences, change behavior during evaluation, and exhibit deceptive or sycophantic responses.  

Structural risk  

Structural risk follows from agentic systems that are tightly coupled, multicomponent ecosystems. Failures can propagate across agents. Hallucinations cascade downstream. Resource exhaustion becomes systemic. Tool misuse enables indirect prompt injection and command execution. Rogue agents can poison peer agents through trust relationships.  

Accountability

Accountability becomes unclear as autonomy increases. Autonomous agents assume human identity permissions, and humans should have clear ownership of these agents, but they don’t, and this model is flawed. Decision paths are opaque and non-deterministic. Logs are fragmented and difficult to interpret. Reproducing an incident will be impossible without explicit design for observability and forensics. An agent compromise is functionally an insider threat, often with better access and fewer behavioral constraints than a human.  

What does defense in depth look like for AI?

Agentic AI runs on software, networks, identities, and data. It must be governed using the same foundational principles that have proven resilient under uncertainty, including secure by design, defense in depth, zero trust, least privilege, continuous monitoring, behavior-based advanced threat detection and containment, and incident response and recovery.

Core components to a Defense in depth Strategy for Securing the use of AI:

• Strong, precise identity control plane to include an identity per agent (cryptographic, non‑shared)
  
  • Privilege monitoring and just‑in‑time access

• Data Governance

• Secure‑by‑default configurations
  
  • Security Posture Management  
  • Zero Trust principles  

• Strong guardrails, deny‑by‑default policies, and isolation

• Explicit instruction hierarchies and controlled context

• Behavioral-based detection across entire enterprise to include inputs, tools, and outputs as well as AI used on the endpoint, across the network, cloud, SaaS, email, and OT
  
  • Runtime anomaly detection and goal‑drift detection
  • Autonomous containment to mitigate risk and minimize damage

• Hard boundaries on autonomy and delegation

• Testing, Evaluation, Validation and Verification  
  
  • Determine when autonomous action and when human in the loop
  • Adversarial training and agent‑specific testing
  • Simulation, red teaming, and chaos testing

• Kill‑switches, rollback, and containment mechanisms
  
  • Forensics data captures, interpretability, autonomous containment, and remediation/recovery plans  

Until standards, tooling, and assurance methods mature, organizations should assume agentic AI systems will behave unexpectedly and design deployments around resilience, behavior-based detection, reversibility, and containment, not efficiency.

How security leaders should prepare for enterprise AI adoption

AI security is not model security alone. Data, pipelines, identities, and agents are first class assets. Many AI attacks succeed through standard cyber failures amplified by AI. Identity, data, and supply chain risk dominate. Behavior-based detection and response are critical, not optional. Logging, provenance, versioning, and forensics data capture of detections are mandatory because you cannot investigate or recover from AI incidents without them.  

Risk will often be visible in behavior before it is clearly defined in policy or guidance. The same pattern has been seen in pre-CVE disclosure detection, where abnormal activity appears before the industry has named or described the vulnerability. AI systems introduce that uncertainty by design.

Security leaders should prioritize controls before AI is fully deployed, avoid generic AI security checklists, integrate AI risk into existing cyber programs, and mitigate the risk of non-deterministic technology with continuous oversight, monitoring, behavior analytics, anomaly detection, autonomous investigation, and autonomous containment.

Visibility has a different connotation with AI. Previously, audit logging worked for software/people, but with Generative AI-based systems, interpretability and explainability is difficult to understand, you cannot "undo" what has been done, or see the logic or control a chain of events. This is why behavioral-based detections and containment becomes critical.  

What capabilities should every AI security program include?

If an organization asked “what must be in place before scaling AI?”:

1. AI Risk board and approval workflow

2. IAM + PAM for all AI services and agents

3. AI asset inventory

4. Prompt/output DLP with sanctioned AI access – This is not just pre- and post- filters, but behavior-based detections of semantic interface as well as behavior-based analysis of output with associated risk context.  

5. Shadow AI identification

6. Secure MLOps – This is an entire paper itself

7. Runtime guardrails and tool restrictions
   
   • Including AI Gateway/SASE/Zero trust/

8. Runtime security with behavior-based detections
   
   • Complete visibility, monitoring, behavior analytics, anomaly detection, risk/intent/context evaluation of anomalies, autonomous investigation and autonomous containment of all AI assets across endpoint, network, SaaS, SASE, cloud, OT, email, and messaging platforms

9. Secure data pipelines and data governance

10. SOC workflow changes from malicious classification workflows to behavior-based detection workflows

11. Remediation plans for AI-related incidents  

Layered Governance and Security Stack for Securing AI  

The following outline considers governance and security tools that should be considered, well-integrated, deployed, tested, operationalized and embedded within security workflows. These tools and controls map to NIST’s CMF for AI.  

These considerations do not need to be implemented in order. Runtime Detect and Respond will help mitigate risk while Governance, Visibility, and Identity mature.

AI security requires continuous visibility and behavioral detection

AI changes how fast systems move, how decisions are made, and how risk propagates. It does not change the fundamentals of security. Organizations that succeed will be the ones that apply those fundamentals rigorously, assume failure, and build systems that can detect, contain, and recover when AI behaves in ways they did not anticipate. Security is not what AI is allowed to do. It is whether the organization can understand, trust, and control what AI actually does in practice.  

Take this guidance to understand different initiatives that organizations should be considering. Securing AI is the most critical component to AI safety. As organizations invest more in AI adoption, they should be investing in security in order to mitigate the risk of AI adoption. Organizations should be evaluating their governance and security stack to include well-integrated tools that are deployed, tested, operationalized and embedded within security workflows. While organizations mature in governance, visibility and identity access management, they should be investing in behavior-based detection and autonomous containment to mitigate AI risk.