TL;DR: AI infrastructure, the LLM gateways, workflow engines, and MCP servers running agentic AI deployments, is now an active attack target. CISA added seven exploited flaws to its Known Exploited Vulnerabilities catalog on September 2, 2026, including critical LiteLLM and Kestra bugs already used for credential theft and cryptomining. INVITE Networks treats AI infrastructure as a control plane requiring the same patching discipline, monitoring, and access controls as any other production system. This page is for CISOs and IT Directors running or evaluating AI agent deployments who need to know what changed and what to do about it. On September 2, 2026, CISA added seven newly exploited vulnerabilities to its Known Exploited Vulnerabilities catalog. Two point at a real shift: attackers are no longer targeting only traditional network appliances, they are going after the infrastructure that runs AI systems. Microsoft and Google-owned Wiz both published research the same week documenting active exploitation of LiteLLM gateways, Kestra workflow engines, and Model Context Protocol (MCP) servers, the connective tissue behind most enterprise AI agent deployments. What Happened With LiteLLM, Kestra, and MCP Servers? Two of the seven newly listed flaws hit AI-specific infrastructure directly. CVE-2026-49869, a CVSS 10.0 command injection bug in the Kestra workflow engine, let attackers create and run arbitrary workflows without credentials. Microsoft traced exploitation to late June 2026, where it was used to establish a reverse shell, explore Docker environments, and deploy a cryptocurrency miner. CVE-2026-59822 in Berri LiteLLM’s MCP endpoint let attackers open an authenticated MCP session using an arbitrary bearer token, then reach the LiteLLM-backed PostgreSQL database to harvest API keys and provider credentials. Neither flaw targets an application. Both target the plumbing connecting AI agents to models, tools, and data. Why Is AI Infrastructure Suddenly a Target? AI infrastructure holds exactly what attackers want: provider API keys, model credentials, and a direct path to compute they can hijack for cryptomining. Microsoft ties this pattern to LiteLLM, Flowise, LangChain, Langflow, ChromaDB, Ollama, and MCP servers broadly, not one vendor. These systems get deployed fast, often by AI teams working outside the change-management process security teams already monitor. That gap, not a flaw in any single product, is the real exposure. What Should IT Leaders Do About AI Infrastructure Security Right Now? Four moves matter most this week: Inventory every LLM gateway, workflow engine, vector database, and MCP server in production, including ones AI teams stood up outside a formal change request. Patch LiteLLM and Kestra immediately if either is in use. CISA’s remediation deadline for federal agencies is September 16, 2026, and the same urgency applies broadly. Treat AI infrastructure credentials, API keys, MCP bearer tokens, database service accounts, like privileged access, not application configuration. Monitor for the behaviors Microsoft flagged: unexpected Docker socket access, new entries in “~/.ssh/authorized_keys,” and outbound traffic consistent with cryptomining or model enumeration. This is the same pattern INVITE flagged in July with JADEPUFFER-style agentic ransomware: attackers moving faster than the infrastructure meant to contain them. See AI Agent Ransomware Is Here for the earlier chapter. INVITE’s enterprise cybersecurity services extend monitoring and vulnerability management to AI infrastructure the same way they cover the rest of the network, and INVITE’s AI consulting practice builds governance into AI deployments from the start. Schedule an AI infrastructure security review with an INVITE security engineer. Frequently Asked Questions: AI Infrastructure Security What is AI infrastructure security? It covers the systems that run AI deployments behind the model itself: LLM gateways, workflow orchestration engines, vector databases, and MCP servers. These typically hold API keys, provider credentials, and direct access to compute, making them a high-value target distinct from the AI application a user interacts with. What is a Model Context Protocol (MCP) server? An MCP server is a standardized interface that lets AI agents connect to external tools, data sources, and systems. Because it sits between an AI agent and the systems it can act on, an exploited MCP endpoint can give an attacker the same reach the agent has. Is LiteLLM safe to use? LiteLLM is widely used and actively maintained, but 2026 vulnerabilities (CVE-2026-42271, CVE-2026-48710, CVE-2026-59822) can chain to bypass authentication or hijack MCP sessions. Organizations running it should patch to the current release and audit MCP endpoint exposure rather than avoid the platform outright. How do we know if our AI infrastructure has been compromised? Watch for unexplained Docker socket access, new entries in “~/.ssh/authorized_keys,” outbound traffic consistent with cryptomining, and API calls enumerating models or credentials that don’t match normal usage. Microsoft’s research ties all of these to the current wave of attacks. Does this affect organizations that only use hosted AI tools like Microsoft Copilot? Less directly. These exploits target self-hosted AI infrastructure, gateways, workflow engines, and MCP servers that IT or AI teams deploy themselves. Organizations using only fully hosted, vendor-managed AI tools carry a smaller version of this exposure, though the same credential hygiene still applies.
