AI Gateways: A New Frontier for Security Risks

Security teams must contend with a shift in their adversary landscape, where traditional methods of securing cloud environments are no longer sufficient. AI gateways—the new frontier of cloud security—are emerging as prime targets for cybercriminals. Recent attacks on Amazon Bedrock-linked AI gateways highlight the urgency and scale of this challenge.

The Hard Truth: If your organization hasn't yet experienced a breach through an AI gateway, it’s only because you’re running out of time to secure them properly. The clock is ticking, and every minute counts before you become another case study in this evolving security crisis.

The legacy approach—focusing on perimeter defenses, manual processes, and static permissions—is no longer adequate in the AI era. We are witnessing a massive transition towards more dynamic and adaptive security models that can handle the inherent risks of agentic AI systems.

AI gateways are becoming brokers for identity, model access, prompts, logs, and policy, making them central control points for AI operations. When exposed over SSH or backed by broad IAM permissions, they pose significant risks. For instance, Soroko's research indicates that one such attack ended in cryptomining, but the bigger concern is centralized model access, identities, and cloud privileges.

To mitigate these risks, security teams must adopt a multi-layered approach:

1. Close Public Admin Paths: Ensure no public admin paths are open to unauthorized access.

2. Remove Long-Term Keys: Where possible, use short-lived API keys instead of long-term credentials.

3. Scope IAM Permissions: Limit permissions to what is absolutely necessary for the task at hand.

4. Monitor Bedrock and Model Access Patterns: Continuously monitor and correlate these with control-plane events.

5. Treat AI Gateways as Privileged Cloud Assets: Monitor administrative actions and prompt activity closely, treating them as high-value targets.

Darktrace's investigation revealed that employees and business functions often expose sensitive information through legitimate interactions, making it easier for attackers to exploit these gateways. Experts advise thinking of AI gateways as a mini supply chain where one weak link can compromise an entire system.

The Hard Truth: Your organization’s security posture is only as strong as the weakest link in this new supply chain. Failures at any point can lead to catastrophic breaches.

Recent incidents, such as Google's Vertex AI SDK allowing RCE through bucket squatting, underscore the vulnerabilities inherent in these systems. Additionally, attacks on legacy tools like REDCap highlight how even established technologies can be exploited when improperly secured.

To stay ahead of the curve, organizations must embrace a new paradigm where visibility and observability are paramount. Continuous review and least privilege practices will become critical in managing these complex environments.

The Hard Truth: The traditional model of security is dead; it’s time to own the engine room of your AI operations or risk becoming another casualty of this ongoing battle.

Are you still renting your capacity, relying on legacy systems and manual processes? Or are you ready to take control of the engine room of your AI infrastructure, ensuring that it's secure against these new threats? The choice is yours, but the time for action is now.

Drop-the-mic Question: Are you prepared to face the future with a robust security posture or will your organization remain vulnerable to these emerging threats?