Skip to content
ROAI

September 4, 2026 · Issue 19 · 5 min read

Your model gateway is on CISA's exploited list, and the bill for fixing it is permanent

CISA added seven actively exploited flaws to its Known Exploited Vulnerabilities catalog on Wednesday, and two of them sit inside the AI stack(opens in a new tab): CVE-2026-59822, an improper authentication flaw in Berri's LiteLLM, and CVE-2026-49869, a command injection flaw in Kestra rated 10.0. Federal agencies have until September 16 to remediate the LiteLLM issue. The reported attacker behavior is the part to read twice. Adversaries establish an authenticated session against the gateway, then harvest model configuration, upstream provider key material, provider endpoints and proxy-issued virtual keys, and drop a cryptocurrency miner on the host on the way out.

LiteLLM is the component many enterprises put in front of their model providers precisely to centralize keys, quotas and spend tracking. That design choice concentrates every provider credential in one process. This is not the first time it has been flagged: an unauthenticated remote code execution chain in the same product went into the catalog in June(opens in a new tab) with a 13 day federal deadline, in a product that reaches more than 200 data connectors. A gateway sitting on your network, holding provider keys and wired into document repositories and data warehouses, is not middleware. It is a credential store that nobody has classified as one.

The cost side moved the same day. Bain published analysis, covered by CIO Dive(opens in a new tab), projecting that a typical $10 billion consumer packaged goods company will see annual IT costs rise 75 percent by 2035 even under disciplined investment. The drivers named are architectural complexity, cybersecurity, data governance, talent, and the rate at which AI platforms go obsolete. Three of those five are the bill for exactly the controls the LiteLLM entry implies. The same piece puts Gartner's forecast for AI model and platform spending at a 63 percent jump to $64 billion, which is the number most 2026 budgets already carry. The 75 percent is the number they do not.

Google shipped Gemini 3.8 Flash this week(opens in a new tab) at $0.75 per million input tokens, alongside a variant that is not for sale. Gemini 3.8 Flash Cyber is gated through a program called Fairwind to government authorities, critical infrastructure operators and software maintainers. Chrome Security reported it produced 2.6 times more correct patches than the best commercial models. That is the second frontier lab inside a week to split its strongest security capability into a vetted tier rather than a price tier. For a procurement file, that changes the question: the best defensive model available is now an eligibility decision made by someone else, and most enterprises are not eligible.

Three events, one news cycle, and not one of them is a benchmark. The gateway your traffic runs through is on a federal exploitation list, the cost of operating AI safely is a step change in the IT baseline rather than a project line, and the strongest defensive capability is allocated by vetting rather than by budget. The question for this quarter's review is not which model. It is who holds your provider keys, what the run rate looks like once the controls are actually funded, and whether anyone in the building has asked to be on the list.

Researched and drafted by an automated workflow, then reviewed and edited by a human editor before publication. Every source is linked. See how we use AI here.

The LiteLLM entry deserves a specific reaction rather than a general one, because the exposure is unusually easy to inventory. There is a finite list of places in your estate where provider credentials are stored in plaintext or near it, and the gateway is almost certainly on it.

Three questions answer most of it. Is the gateway reachable from anything other than the applications that need it, and if so, why. Which upstream provider keys does it hold, and when were they last rotated. Who owns the service account it runs as, and does that person know they own it. An organization that cannot answer the third question quickly has a gateway that nobody is responsible for patching by September 16 either.

The rotation question is the one that gets deferred. Harvested provider key material does not announce itself. It shows up as usage, on a bill, from an account that looks like yours, and the cost signal is delayed by a billing cycle. If the gateway was exposed, the keys behind it are not trustworthy whatever the patch status now says.

The agent credential inventory published a day later is the same problem one layer up. Agents get built in a studio, connected to enterprise tools, and given an OAuth token, an API key, a service account, or a borrowed human login. The agent gets reviewed. The identity behind it does not, and its permissions accumulate well past the original job. Owner, reachable tools, credential type, effective authority, and observed runtime behavior against approved intent is a short enough list to run against every agent in production this month.

None of this is a reason to slow down. It is a reason to price the thing honestly. Bain's 75 percent is not a warning about waste, it is what a functioning AI operating model costs once security, data governance and platform churn are funded rather than assumed. A budget that funded models and integration but not credential lifecycle, gateway hardening and agent identity has not been cut. It has been underwritten by whoever finds the gateway first.

The Fairwind point is worth carrying into the vendor conversation. When the strongest defensive capability ships to a vetted list rather than to a price tier, the relevant question for a security vendor is no longer what model they use. It is whether they are on the list, and what they can demonstrate about it.

Also worth knowing