Zenity reported active exploitation attempts in the wild against two LiteLLM control-plane paths. Attackers sent POST requests to /guardrails/test_custom_code carrying Python probes and CVE-2026-40217 sandbox-escape payloads; in the standard root-running proxy image a successful escape becomes root-level code execution inside the container. Separately, attackers sent /health/test_connection requests with an attacker-controlled api_base nested under litellm_params together with api_key values referencing server-side secrets such as LITELLM_MASTER_KEY, causing the gateway to deliver credentials to a destination of the attacker's choosing. Because the gateway is where model routing, provider credentials, policy checks and budget control meet, a compromise exposes the credential and routing substrate shared by every downstream AI application. Remediation spans both patched LiteLLM releases and deployment architecture: non-root containers, restricted code execution, default-deny egress, route policy that cannot be supplied by request parameters, and fast key invalidation.
ASSESSED SYSTEM
A representative LiteLLM AI-gateway proxy deployment as it stood when Zenity observed exploitation attempts (reported 2026-06-30): the vendor's standard root-running proxy container image, running a release affected by CVE-2026-40217 and by the nested api_base connection-test behaviour, exposing the /guardrails/test_custom_code and /health/test_connection control-plane paths, holding LITELLM_MASTER_KEY and upstream model-provider API keys in its process environment, with no default-deny egress. Representative rather than named: the brief reports in-the-wild attack traffic against LiteLLM proxies generally, not one identified victim organisation.
OUT OF SCOPE
Patched LiteLLM releases and hardened deployments (non-root container, restricted interpreter, default-deny egress, reviewed route bundles); the downstream AI applications that consume the gateway; the upstream model providers; the attacker infrastructure; and any specific organisation's LiteLLM instance.
Architecture: Tool-Calling LLM / Connected GenAI (decision tree Q3) — Q1 NO — no agent topology; the proxy routes requests and does not host coordinating agents. Q2 NO — no planner loop, task state, or memory; every action is request-driven with no autonomous multi-step workflow. Q3 YES — the gateway invokes external model-provider APIs on behalf of downstream AI applications using server-held provider credentials, exposes a server-side custom-code execution path (the guardrail tester, a dynamic-code boundary per AID-H-025.002), and performs outbound connection tests to destinations supplied in litellm_params.api_base. Evidence artefacts: the two exploited control-plane endpoints, the litellm_params routing parameter, and the provider-key/route-policy inventory the brief instructs operators to enumerate. Tier 3: Tier 3 Internal — the gateway is shared AI infrastructure operated inside an organisational boundary for controlled users (downstream applications, developers and administrators); compromise harms the organisation and its downstream AI apps rather than causing immediate physical, financial or societal harm at scale. Instances fronting consumer-facing products or financial workflows would tier up; internet reachability is scored in As, not in the tier.
Documented attack or failure path
- Attacker locates an internet-reachable LiteLLM proxy and its control-plane routes.
- Path A: POST to /guardrails/test_custom_code with Python probe code, then a CVE-2026-40217 sandbox-escape payload, reaching the dynamic-code execution boundary.
- Escape from the restricted interpreter yields code execution in the proxy container, which in the vendor's standard image runs as root.
- Path B: POST to /health/test_connection with an attacker-controlled api_base nested under litellm_params and an api_key value referencing a server-side secret (for example LITELLM_MASTER_KEY).
- The gateway performs the outbound connection test and delivers the referenced provider or master credential to the attacker-controlled destination.
- With the master key, an attacker can mint or modify virtual API keys, so incident response must remove attacker-created keys as well as rotate the originals.
Observed controls and bounded outcomes
Positive credit is given only where the record directly demonstrates a control operating. Recommended or merely presumed controls receive no positive scoring credit.
- The custom-code guardrail path was not an open exec: it ran inside a restricted interpreter sandbox, and defeating it required a dedicated sandbox-escape vulnerability (CVE-2026-40217) rather than a plain code-submission bug.
- The response guidance recommends hunting the named control-plane routes and outbound destinations. That recommendation does not prove the assessed deployment retained reconstructable request records, so it receives no positive scoring credit.
- Deterministic upstream fixes exist for both paths, with a clear affected/fixed version boundary operators can reconcile against fleet-wide.
- External researcher telemetry detected the exploitation attempts and published indicators before most operators were hit, giving defenders a retro-hunt window.
Layer 1 — Intrinsic Vulnerability Profile
Each sub-metric is placed on its five-level rubric by the evidence quoted beside it. Missing applicable evidence remains unknown. The displayed midpoint and interval are scenario values, not inferred control performance.
| Sub-metric | Score | Rubric basis | Evidence |
|---|---|---|---|
| Robustness (Ro) — scenario interval 0.00–1.00 (midpoint 0.50), Tier 3 MVT 0.40 indeterminate | |||
| Fairness (Fa) — scenario interval 0.00–1.00 (midpoint 0.50), Tier 3 MVT 0.45 indeterminate | |||
| Transparency (Tr) — scenario interval 0.00–1.00 (midpoint 0.50), Tier 3 MVT 0.45 indeterminate | |||
| Privacy (Pr) — scenario interval 0.06–0.81 (midpoint 0.44), Tier 3 MVT 0.50 indeterminate | |||
| Pr-3Data Minimization Compliance | 0.25w 0.25 | Pr-3 0.25: some minimisation exists on the primary serving path, but a secondary developer/debug path retains unnecessary sensitive material — here the master credential itself, reachable from a request parameter. | The guardrail-tester execution path ran with the full production secret environment in process: attacker payloads referenced os.environ and LITELLM_MASTER_KEY, and the remediation guidance is to run custom-code testing 'in a non-root, short-lived, restricted interpreter or microVM environment with no production secrets'. A developer test feature therefore carried the gateway's master and provider credentials with no documented necessity.source: brief |
| Containment (Cn) — scenario interval 0.11–0.59 (midpoint 0.35), Tier 3 MVT 0.50 indeterminate | |||
| Cn-1Scope Enforcement | 0.25w 0.16 | Cn-1 0.25: basic boundaries exist but are enforced inconsistently, and simple parameter manipulation exceeds intended scope. | Two request-parameter paths exceeded the intended scope of their endpoints: custom guardrail code could reach filesystem, network and privileged APIs after sandbox escape, and a health-check accepted an arbitrary outbound destination nested under litellm_params plus a reference to a server-side secret. Boundaries existed (a restricted interpreter, a nominal route configuration) but were bypassed by ordinary parameter manipulation.source: brief |
| Cn-2Escalation Prevention | 0.25w 0.16 | Cn-2 0.25: basic containment/role controls exist but are defeated by the delivered attack, with no least-privilege layer behind them; placed at the bottom of the band because the container runs as root by default. | Zenity called out root execution in the official LiteLLM Docker path, so a sandbox escape lands as root-level code execution inside the container with no privilege separation, dropped capabilities or read-only filesystem. A confinement control existed and was defeated; nothing behind it limited the resulting privilege.source: brief |
| Cn-5Agent Identity Integrity | 0.25w 0.11 | Cn-5 0.25: basic API-key / shared-secret authentication, no workload-to-workload verification, weak rotation, limited auditability. | AID-H-004.002 (Service & API Authentication) is rated Very High for this case — the calling service, workload or integration was not authenticated before requests reached the guardrail-tester and connection-test endpoints. LiteLLM's identity model is a long-lived master key plus derived virtual keys (shared secrets), which the incident-response guidance treats as long-lived credential objects requiring alert-driven eviction and rotation rather than short-lived, cryptographically bound identities.source: brief |
| Cn-6Action Reversibility Classification Rate | 0.00w 0.09 | Cn-6 0.00: no reversibility classification is performed before execution; the observed automated actions executed ungated (ARCR = 0). | The connection-test endpoint transmitted a server-side credential to an attacker-specified external destination on request. Disclosure of a long-lived master or provider key to an external party is a delegated-irreversible action — it cannot be undone, only rotated — yet no pre-execution reversibility classification or gate existed for it; the same is true of the guardrail tester's arbitrary code execution.source: brief |
Unknown, not N/A: 18 applicable sub-metrics lack admissible public evidence. The lower, midpoint, and upper scenarios evaluate each at 0.00, 0.50, and 1.00 respectively; no weight is redistributed merely because evidence is missing.
Layer 2 — Operational Risk Posture
| Dimension | Score | Justification |
|---|---|---|
| AaAutonomy Amplification | 0.50w 0.20 | The gateway performs its actions — route selection, provider invocation with server-held credentials, guardrail code execution, connection tests — automatically and unattended within pre-defined boundaries, with human oversight exercised through monitoring rather than per-action approval. It has no independent goal-setting or planning authority: every action is triggered by an inbound request. Human-on-the-loop (0.50) rather than supervised autonomy (0.75). |
| AsAttack Surface Exposure | 0.85w 0.25 | Above the 0.75 anchor with documented justification. The deployment is internet-reachable and was receiving real attacker traffic on its control-plane routes; request payloads were untrusted and unvalidated to the point of controlling the gateway's own outbound destination (litellm_params.api_base), and the guardrail tester accepts attacker-supplied code. That is materially worse than the 0.75 anchor's 'partially trusted' external data ingestion. It falls short of 1.00 because no multi-agent communication or external MCP tool integration is in scope. elevated |
| CpCascade Potential | 1.00w 0.30 | No System Dependency Graph is published for any affected deployment, so the spec's DGC < 0.90 rule applies; the reconstruction also triggers the 1.00 anchor on its own merits. An ungated request path reached the LITELLM_MASTER_KEY, a credential-issuing capability (P4 — it mints and modifies virtual API keys, which is why incident response must remove attacker-created keys), and a second ungated path reached root code execution inside the proxy container that fronts every downstream AI application.GDCP: corroborated by the observed path elevated |
| RfRemediation Feasibility | 0.25w 0.25 | Deterministic upstream fixes exist for both paths (updated LiteLLM releases covering CVE-2026-40217 and the nested api_base behaviour), which alone would argue for 0.00. Scored 0.25 because the brief's remediation is explicitly broader than the patch — non-root containers, restricted or removed custom-code testing, default-deny egress, route policy moved into approved bundles, and fleet-wide master/provider key rotation — deployment-infrastructure work measured in days, plus digest-level fleet readback. |
Nelevated = 2 (dimensions strictly above 0.75) → CRM = 1.15.
Compound Risk Alert. Two or more dimensions are simultaneously elevated (spec 3.2.2); architectural decomposition is recommended before deployment.
Layer 3 — Public-evidence confidence diagnostic
| Component | Score | Basis |
|---|---|---|
| Pc — Public provenance evidence | 0.25 | The software component's lineage is unusually well documented for a public incident — named product, affected versions, CVE identifier, official container image — but everything deployment-specific is unknown: no AIBOM, no model or provider inventory for the assessed proxy, no tool/route manifest history, no identity policy, no owner. That is the 0.25 'minimal provenance record' anchor, not the 0.50 anchor which requires enumerated datasets, prompt lineage and tool inventory. |
| Ec — Public evaluation coverage | 0.22 | coverage 0.22 (5 of 23 applicable sub-metrics) × independence 1.00 × fidelity 1.00. No Full, Standard, or Lite pathway is claimed for a retrospective article. |
| Tf — Public-evidence freshness | 0.35 | Evidence dated 2026-06-30; age 44 days on the workpaper reference date. Components: C_event 0.35 · C_monitor 0.65 · T_containment 0.72 · T_calendar 0.85 · C_evidence 0.85. Binding term: C_event. dt_days = 44, measured from the primary disclosure (Zenity, 2026-06-30) to the assessment date 2026-08-13; the AIDEFEND brief republished the analysis on 2026-07-02 without adding primary evidence. agentic = true: a Tool-Calling / Connected GenAI control plane with runtime-mutable route and credential bindings, so the containment staleness floor (M_Cn = 2.0) applies. baw = false: the gateway holds no cross-session memory writable by a model, runs no agent-to-agent channel, does not self-modify its prompts or configuration, and closes no feedback loop — the request-supplied api_base was attacker input, not model-written state. C_event = 0.35 (major): confirmed in-the-wild exploitation of the assessed control-plane paths with credential exposure that cannot be ruled out; the spec's threat-override row would independently cap Tf at 0.50 for exploited relevance. C_monitor = 0.65: the exploitation was surfaced by an external researcher's telemetry rather than by deployment alerting, and the brief's guidance is retrospective log hunting, indicating no alert routing on these routes. C_evidence = 0.85: an open identity/credential gap — master and provider keys must be treated as exposed until rotation and attacker-created key removal are verified. |
Public-evidence ACI = (Pc × Ec × Tf)1/3 = 0.27 — diagnostic status: Invalid as assessment-of-record evidence. It describes the evidence available to this case study, not the assurance of the underlying system, and is not inserted into the normalized-assurance scenario ERS.
Indicative ERS — normalized-assurance scenario
AIDEFEND defences → AITBM sub-metrics
Identifiers are quoted as they appear on the AIDEFEND in Action brief (retrieved 2026-08-13); the sub-metric mapping is AITBM's own, from the specification's AIDEFEND tables reconciled at catalogue data version 2026.08.05. AIDEFEND renumbers identifiers between releases, so the data version travels with every mapping and neither side's IDs should be cited without one. A mapping identifies a possible evidence route; a recommendation does not prove that the control was implemented or effective and receives no scoring credit by itself.
| Technique | Defence | Priority | Evidences |
|---|---|---|---|
| AID-H-004.002 | Service & API AuthenticationParent AID-H-004 (Identity, Access & Trusted Communication for AI Systems), dataVersion 2026.08.05. Authenticating the calling workload before the guardrail-tester and connection-test endpoints is the missing control behind the Cn-5 = 0.25 score; the same control produces the actor-identity field Tr-3 currently lacks. | Very High | Cn-5 Tr-3 |
| AID-H-025.002 | Safe Interpreter EnforcementParent AID-H-025 (Unsafe Code Execution Prevention), dataVersion 2026.08.05, maps to Cn-3 in the reconciled catalogue. The guardrail tester is the dynamic-code boundary that CVE-2026-40217 escaped; restricted interpreters, deny-by-default execution gateways and ephemeral environments are the direct evidence source for hardening it. Operationally it also bears on the Cn-1 scope finding, but no Cn-1 mapping is asserted beyond the lookup. | Very High | Cn-3 |
| AID-I-001.001 | Container-Based IsolationParent AID-I-001 (AI Execution Sandboxing & Runtime Isolation), dataVersion 2026.08.05. Non-root containers, dropped capabilities and read-only filesystems are the missing blast-radius control behind the Cn-2 = 0.25 justification; the catalogue records AID-I-001 as evidence for Pr-2 only, so no additional mapping is invented. | Very High | Cn-7 Pr-2 |
| AID-I-001.004 | Sandbox Network Egress RestrictionsParent AID-I-001, dataVersion 2026.08.05. Default-deny sandbox egress is the last line of defence that would have blocked reverse shells and secret-exfiltration callbacks after successful guardrail code execution. | High | Cn-7 Pr-2 |
| AID-I-002.002 | Secure External AI Service ConnectivityParent AID-I-002 (Network Segmentation & Isolation for AI Systems), dataVersion 2026.08.05. DNS/SNI allowlists and governed outbound gateways directly prevent the nested api_base destination from ever receiving provider or master keys. | High | Cn-4 |
| AID-H-033.004 | Route Policy Bundle Versioning, Approval, Canary & RollbackParent AID-H-033 (AI Gateway Routing Integrity & Policy-Preserving Failover), dataVersion 2026.08.05. Moving model destinations into reviewed, versioned route bundles removes the request-supplied api_base pattern that produced the Cn-1 = 0.25 and Pr-3 = 0.25 findings. | High | Cn-1 Cn-2 Cn-3 Cn-7 Pr-3 Ro-3 Tr-3 |
| AID-H-003.010 | Deployed AI Software Vulnerability Remediation LifecycleParent AID-H-003 (Secure ML Supply Chain Management), dataVersion 2026.08.05. Digest-level fleet readback against both exploited CVEs is the evidence source that would support the Rf = 0.25 remediation claim at fleet scale. | High | Ro-4 Tr-4 |
| AID-E-001.001 | Root & Long-Lived Credential Object EvictionParent AID-E-001 (Compromised Credential, Session, Principal & Grant Eviction), dataVersion 2026.08.05. Alert-driven revocation of the master key and upstream provider keys, plus removal of attacker-created keys, is what would lift the C_evidence = 0.85 cap. | High | Cn-5 |
| AID-E-004 | Incident Exploit-Path Closure VerificationAID-E-004 is absent from the reconciled AIDEFEND-to-AITBM lookup at dataVersion 2026.08.05; no AITBM sub-metric mapping is asserted for it. Recorded because independent replay of both payloads in an isolated clone is the closure evidence the assessment would need to raise Tf. | High | ACI:C_event recovery ACI:containment/behavioral re-attestation |
WHAT THIS CASE TEACHES
An AI gateway with no agents, no memory and no autonomy still classifies as Connected GenAI and still forces Cp = 1.00 on its merits — because the corroborating path runs through a credential-issuing (P4) node rather than through autonomy, showing that AITBM's cascade term is driven by reachable privilege, not by how 'agentic' the system sounds.
Sources: AIDEFEND in Action brief — LiteLLM Control Plane Is Being Hit in the Wild (2026-07-02) · Zenity Labs — What You Don't Know Can Hurt You: Why AI Security Research Needs to Move Out of the Lab and Into the Wild, Ayush RoyChowdhury & Avishai Efrat (2026-06-30)