AI agents that pass authentication can still drift, expose data, or get memory-poisoned

The useful part

The gateway is the first control teams reach for, but it is the one they are least ready to run. This is because gateways sit on top of identity and attribution layers that are mostly not there. In June, CISA added a LiteLLM flaw to its Known Exploited Vulnerabilities catalog after attackers were caught abusing it in the wild.

How it works

• If the control plane is unaware of which agent is acting, who delegated the work, what task the agent is to perform, and what credentials are being used, then the context is incomplete.
• The bug ran commands on the host through the gateway itself, and chained with a second flaw it required no credentials.
• It was one of seven common vulnerabilities and exposures (CVEs) disclosed in that single AI gateway in a month.
• This is the layer many enterprises reach for first to secure their AI agents.
• When considering secure agent architecture, gateway controls should not be the first control.

What to take from it

Most models on the maturity of agent security describe the controls a company will need in the future. In what order should these controls be layered in conjunction with an identity and access management system that is already in place? Enforcement is taken early, while the identity and attribution context it depends on has yet to be developed.