AI Gateways Like LiteLLM Are a High-Value Target: Red Team Research Shows How Traffic Could Be Rerouted and Altered

Many organisations now use an AI gateway to manage access to large language models. LiteLLM is a popular open-source example. It offers one interface across providers such as OpenAI, Anthropic, Azure OpenAI and Bedrock, and staff are issued "virtual keys" instead of the real provider keys. The catch is that the gateway holds those real keys and sees all configured inference traffic.

Embrace The Red argues this makes gateways a high-value target, not only for data and intellectual property theft, but also for changing model responses and triggering tool invocation. The research describes techniques that red teams can use in authorised operations to show how LLM traffic could be rerouted, intercepted and modified, and it notes what defenders can watch for. The author says it focuses on LiteLLM but applies in principle to other AI gateway products. Without proper monitoring and security controls, several of these outcomes could happen together and go unnoticed.

Importantly, the rerouting relies on documented gateway-management features, since an admin credential is meant to be able to change where a model routes. The routing change is not itself a vulnerability; the real weakness is usually how an attacker obtains that credential. The author points to a number of serious vulnerabilities in recent months, including one added to CISA's Known Exploited Vulnerabilities catalog, which indicates exploitation in the wild. Missing patches therefore leave plenty of openings.