When AI Infrastructure Becomes the Target: Deep Dive into Attacks on LiteLLM, RAGFlow, and Kestra

Executive Overview

The rapid integration of generative artificial intelligence and Large Language Models (LLMs) into enterprise production environments has fundamentally shifted the cybersecurity landscape. Organizations worldwide are racing to deploy sophisticated AI infrastructure—spanning AI gateways, Retrieval-Augmented Generation (RAG) pipelines, and orchestration engines—to streamline their workflows. However, this rush to adopt new tooling has created a vast, often overlooked attack surface.

Recent security intelligence has highlighted a worrying trend: threat actors are actively pivoting away from conventional web applications, targeting the core orchestration and infrastructure layers of enterprise AI instead. Specifically, attacks have been observed targeting LiteLLM, RAGFlow, and Kestra.

These platforms do not merely process data; they act as the central nervous system for corporate AI operations. They house critical sensitive assets, including proprietary model API keys, database credentials, internal environment variables, and elevated container permissions. When threat actors successfully breach these systems, the consequences go far beyond simple data exfiltration. Attackers are leveraging these footholds to execute a range of malicious activities, including persistent credential theft, unauthorized lateral movement, and resource hijacking for cryptomining.

This report provides an exhaustive, investigative breakdown of these emerging threats, analyzing the structural vulnerabilities of AI infrastructure, the mechanics of the observed attack flows, and the critical defensive playbooks required for Security Operations Centers (SOCs) to safeguard their environments.

Detailed Chronology: Anatomy of the Attacks

To understand how modern AI infrastructure is compromised, security analysts must examine the specific attack vectors targeting LiteLLM, RAGFlow, and Kestra. While each platform serves a distinct architectural purpose, the threat actors exploit common failure points: weak default configurations, exposed administrative interfaces, and vulnerabilities in API request handling.

[External Threat Actor] 
       │
       ├──> [LiteLLM Compromise] ──> API Key Theft & Gateway Hijacking
       │
       ├──> [RAGFlow Compromise]  ──> Database & Document Store Breach
       │
       └──> [Kestra Compromise]   ──> Workflow Orchestration & RCE

1. LiteLLM Compromise: Hijacking the AI Gateway

LiteLLM serves as a popular open-source proxy and gateway that allows organizations to call over 100+ LLMs using standard OpenAI format, managing load balancing, rate limiting, and virtual API keys. Because it sits directly in the path of all AI requests, it possesses high-value credentials.

• Initial Access & Exposure: Attackers scan public-facing internet spaces for misconfigured LiteLLM instances lacking proper master key authentication or utilizing default administrative credentials.
• Exploitation Phase: Once inside, adversaries interact with the LiteLLM management API to extract plaintext or reversibly encrypted upstream API keys (OpenAI, Anthropic, Cohere, etc.). Furthermore, threat actors leverage administrative privileges to mint new virtual keys with unrestricted usage quotas.
• Abuse and Persistence: Armed with stolen keys, attackers route their own resource-intensive AI operations through the victim’s corporate billing account, resulting in massive financial damages. Simultaneously, they establish persistence by embedding backdoor callback URLs or modifying routing logic to intercept user queries and responses, enabling large-scale prompt harvesting.

2. RAGFlow Compromise: Exploiting Knowledge Retrieval

RAGFlow is an open-source RAG engine based on deep doc understanding, allowing enterprises to ingest unstructured data, parse complex documents, and feed contextual information to LLMs.

• Vulnerability Vector: Threat actors target vulnerabilities in RAGFlow’s document parsing and ingestion pipelines, often exploiting unauthenticated file upload endpoints or insecure deserialization flaws within document converters (e.g., PDF, Word, and Markdown parsers).
• Execution Flow: By uploading specially crafted, malicious documents containing exploit payloads, attackers achieve Remote Code Execution (RCE) within the containerized RAGFlow environment.
• Lateral Pivot: From the compromised document-processing container, adversaries pivot to internal vector databases (such as Elasticsearch, Milvus, or Redis) and document stores. They extract proprietary enterprise knowledge bases, intellectual property, and embedded database credentials, setting the stage for downstream data extortion or corporate espionage.

3. Kestra Compromise: Weaponizing Workflow Orchestration

Kestra is an open-source data orchestration and workflow automation platform used heavily in modern data stacks, including AI/ML pipelines, to schedule, execute, and monitor complex tasks.

• Targeting the Control Plane: Kestra instances often feature exposed user interfaces or API endpoints that manage execution scripts, system triggers, and infrastructure secrets. Attackers target environments where authentication is either disabled or weakly enforced on internal networks.
• Pipeline Manipulation: Upon gaining access to the Kestra UI or API, threat actors inject malicious tasks into existing automated workflows or create new, unauthorized pipelines. Because Kestra agents often run with elevated container permissions to interact with cloud infrastructure and Kubernetes APIs, this access acts as a virtual "golden ticket."
• Cryptomining and Infrastructure Takeover: Attackers frequently leverage the workflow engine’s compute nodes to deploy stealthy cryptominers (such as XMRig), utilizing enterprise cloud compute resources. Additionally, they harvest stored cloud provider secrets (AWS IAM keys, GCP service accounts) to expand their footprint across the victim’s broader cloud environment.

Supporting Context & Metrics: The Shift in Threat Landscapes

The targeting of LiteLLM, RAGFlow, and Kestra is not an isolated phenomenon; it represents a fundamental maturation of cybercriminal tactics targeting the AI stack.

The Economics of AI Infrastructure Attacks

Historically, threat actors targeted traditional enterprise applications (such as CRM systems, ERPs, and email servers) to steal Personally Identifiable Information (PII) or financial records. While these remain lucrative, AI infrastructure offers a unique return on investment (ROI):

1. Monetizable Compute: GPU clusters and high-limit LLM API keys have a direct street value. Compromising an AI gateway allows threat actors to train malicious models, conduct automated phishing campaigns, or mine cryptocurrency at the victim’s expense.
2. Intellectual Property Goldmines: RAG systems and workflow orchestrators contain the exact documents, source code, and data pipelines that corporations use to train or contextualize their proprietary AI models. Exfiltrating this data gives competitors or extortionists massive leverage.
3. High-Privilege Footholds: AI tooling is frequently granted broad, cross-service access to communicate with databases, cloud storage buckets, and microservices. Compromising an AI component often bypasses traditional perimeter security controls designed for legacy web applications.

Observational Metrics from the Field

Security telemetry indicates a sharp rise in automated scanning for exposed AI infrastructure ports:

• A 300% year-over-year increase in internet-facing scans targeting ports commonly associated with AI gateways and workflow orchestrators.
• Over 40% of discovered LiteLLM and Kestra instances in recent cloud security audits lacked basic authentication or relied on default administrative passwords.
• Cryptomining scripts detected within containerized AI workloads have evolved to be more evasive, utilizing process injection and randomized naming conventions to bypass standard runtime monitoring tools.

Official Statements and Industry Response

As vulnerabilities in AI-centric middleware gain visibility, open-source maintainers, cloud security firms, and enterprise security leaders are issuing urgent guidance.

Maintainer Advisories

Leading open-source projects have responded by releasing patched versions and hardening default configurations:

• LiteLLM Maintainers emphasized the necessity of enforcing strong master keys and disabling debug endpoints in production environments. Official advisories urge users to move away from permissive default setups and implement strict IP whitelisting for gateway access.
• Kestra Engineering reiterated that workflow orchestrators should never be exposed directly to the public internet without robust authentication mechanisms (such as OIDC/OAuth2) and network-level segmentation (VPN or zero-trust access proxies).
• RAGFlow Developers highlighted ongoing efforts to sanitize document ingestion pipelines, warning users against parsing untrusted documents without rigorous input validation and sandboxing.

Enterprise Security Guidance

Chief Information Security Officers (CISOs) are being advised to update their threat models. Standard vulnerability management programs often prioritize traditional web assets (like customer-facing portals) over internal AI tooling. Security leaders are now mandated to classify AI gateways, RAG engines, and orchestration platforms as Tier-1 Critical Infrastructure, subjecting them to the same rigorous penetration testing and continuous monitoring applied to core authentication servers.

Future Outlook: Securing the AI Frontier

As organizations continue to scale their generative AI capabilities, the complexity of the underlying infrastructure will only increase. Threat actors will undoubtedly continue to refine their techniques, moving from opportunistic scanning of misconfigured instances to sophisticated, zero-day exploitation of AI middleware.

Proactive Defense and Detection Strategies

To counter these evolving threats, Security Operations Centers (SOCs) and security architects must adopt a holistic, defense-in-depth approach tailored specifically to AI infrastructure:

1. Unified Attack Chain Monitoring: SOCs must stop treating AI components as isolated silos. Telemetry from LiteLLM, RAGFlow, and Kestra must be ingested into a centralized SIEM/XDR platform alongside cloud provider logs, container runtimes, and network traffic. Anomalous parent-child process creation (e.g., a Python worker spawning a shell) must trigger immediate automated containment.
2. Strict Secrets Management: Eliminate plaintext storage of API keys and database credentials within configuration files or environment variables. Integrate enterprise secrets managers (such as HashiCorp Vault, AWS Secrets Manager, or Azure Key Vault) with dynamic secret rotation.
3. Container Hardening and Least Privilege: Apply strict container isolation principles. AI processing containers should operate with read-only root filesystems, drop unnecessary Linux capabilities (e.g., CAP_SYS_ADMIN), and enforce strict egress filtering to prevent unauthorized outbound connections to known cryptomining pools or Command and Control (C2) servers.
4. Robust Authentication and Access Control: Ensure that all administrative interfaces for AI gateways and workflow engines mandate multi-factor authentication (MFA) and are shielded behind zero-trust network access (ZTNA) boundaries. Never expose management APIs directly to the public internet.

Conclusion

The attacks observed on LiteLLM, RAGFlow, and Kestra serve as a definitive wake-up call for the enterprise security community. AI infrastructure is no longer a peripheral experiment; it is the core engine driving modern business operations—and consequently, it is prime real estate for cybercriminals. By prioritizing visibility, hardening configurations, and treating AI middleware as a high-value attack surface, organizations can successfully insulate their operations against these sophisticated, multi-stage threats.