August 18, 2026 · Issue 2 · 4 min read
Your AI gateway got repriced at $7 billion and breached at 2,500 companies in the same week
The model routing layer stopped being plumbing this month. On August 12, CloudSEK published the scale of the LiteLLM supply chain compromise: more than 2,500 organizations and roughly 434,000 CI/CD pipelines touched by two backdoored PyPI packages that were live for about 40 minutes in March. The named exposure list includes Nvidia, AWS, Cisco, Salesforce, ServiceNow, FedEx, Airbus, and Volkswagen. Four days later, Bloomberg reported Stripe had agreed to buy OpenRouter, a competing model gateway, for more than $7 billion. OpenRouter raised at a $1.3 billion valuation in May. That is a 5.4x markup in three months.
Read those two facts together and the conclusion is uncomfortable. The component the market just priced as critical infrastructure is the same component that turned out to be the richest credential target in the enterprise AI stack. A gateway exists to hold every model provider API key in one place and route across them. That is its function, and that concentration is exactly what made the LiteLLM payload valuable. CloudSEK's guidance was to treat every secret reachable from a LiteLLM deployment as compromised.
Most AI gateways entered these companies as a developer convenience, below the threshold that triggers a vendor security review. They were adopted to avoid provider lock-in, which is a real and defensible goal. The result is a component with production blast radius and pilot-grade governance.
The regulatory timing sharpens this. Article 50 of the EU AI Act became enforceable on August 2, and it assigns disclosure duties differently to providers and to deployers. A routing layer that swaps models transparently is precisely the architecture that makes the provider-versus-deployer line hard to answer under audit.
Three questions belong in the next architecture review. Who owns the AI gateway on the org chart. Which provider credentials does it hold, and when were they last rotated. And if Stripe ends up owning the routing layer, does that change the vendor risk rating of a component nobody rated in the first place.
Researched and drafted by an automated workflow, then reviewed and edited by a human editor before publication. Every source is linked. See how we use AI here.
The cheapest useful action this week is an inventory, not a policy. Find every AI gateway, model router, and LLM proxy running in production, including the ones a team stood up without a purchase order. For each one, write down which provider credentials it holds and the date those credentials were last rotated.
That list is usually shorter than people expect and older than they expect. It is also the list a CISO will ask for the moment the next routing-layer compromise makes the news, and the list that decides whether the answer takes an hour or a quarter.
Also worth knowing
- LiteLLM supply chain attack affected 2,500 companies and 434,000 CI/CD pipelines(opens in a new tab)
DevOps.com
CloudSEK named Nvidia, AWS, Cisco, Salesforce, FedEx, Airbus and Volkswagen among the exposed. The malicious packages were live for 40 minutes. Automated builds did the rest.
- Stripe will acquire AI gateway startup OpenRouter for more than $7 billion(opens in a new tab)
TechCrunch
A 5.4x markup on a May valuation of $1.3 billion. The layer your developers picked to avoid lock-in is being bought by a payments company with its own interest in the routing.
- The EU begins enforcing the AI Act, putting general-purpose models under direct supervision(opens in a new tab)
Help Net Security
The AI Office can now demand technical documentation, run its own evaluations, and fine up to 15 million euros or 3% of worldwide turnover. Providers owe documentation downstream.
- AI Act transparency obligations take effect, splitting duties between providers and deployers(opens in a new tab)
Cooley
Deployers owe disclosure on emotion recognition and on deepfake content. Chatbot disclosure sits with providers. Know which one your architecture makes you before an auditor decides.