A gateway is a concentration sold as a control. Every product examined centralises provider keys, tool definitions and routing policy into one process, then ships logging and least-privilege tool access while leaving sandboxing, default-deny egress and short-lived per-agent credentials to the buyer. Buy it for routing, cost control and a spend ledger. Do not record it as the agent security boundary.
The pitch for an AI gateway is that scattered model access becomes governed model access. The architecture that delivers the governance is the same architecture that creates a single object worth stealing, and the intrusions already on record went straight at it. Before the gateway, upstream provider keys lived in the applications that used them. Afterwards they live in one row set, next to the routing policy and the tool definitions, in a process that talks to the internet.
Microsoft's security team published three investigations on 26 August 2026 covering an LLM gateway, a document-processing pipeline and a workflow orchestrator. Three different products, three different root causes, one common outcome: code execution in a process holding credentials for systems the attacker had no path to before. In the LiteLLM case the investigators watched attackers read process environment at PID 1 and then the proxy's own PostgreSQL schema, recovering model configuration, upstream provider key material, provider endpoints and the virtual keys the proxy had issued. Reading /proc/1/environ is not a sophisticated technique. The significance is the yield: against one application server it returns that application's credentials, against the gateway it returns the estate's.
This report scores four gateway products shipping into enterprises today, Tailscale Aperture, Nutanix Agent Gateway, Snowflake Cortex AI Gateway and Kong AI Gateway, against the nine control areas in the UK NCSC's 20 August 2026 interim advice on agentic AI. The method bounds the finding and is worth stating plainly: it compares published feature documentation against published guidance, not deployment against guidance. A capability that exists in a product but is absent from its documentation scores zero here. That is a real weakness in the method, and it is also most of the point, because a buyer approving an agent deployment has the documentation and not much else.
Four things are in scope and everything else is deliberately excluded: the compromises of AI-adjacent workloads Microsoft published on 26 August 2026 with the CVE records behind them, the agent-assisted post-compromise tooling Cisco Talos attributes to UAT-10147, the NCSC's interim advice on the cyber risk of agentic AI, and the governance features documented by four gateway products shipping today. Vendor feature documentation is treated as a marketing artifact whose silences are as informative as its claims. CVSS scores are quoted from the advisory that assigned them, and where two bodies scored the same flaw differently the difference is left visible rather than averaged away.
LiteLLM's proxy stores model-provider API keys, the proxy master key, database connection strings and proxy-issued virtual keys in its own PostgreSQL schema. Microsoft's investigators observed attackers reading that database directly after execution on the host, recovering model configuration, upstream provider key material, provider endpoints and the virtual keys the proxy had issued. Environment variables recovered from PID 1 included the master key, database connection strings, UI credentials, tokens and passwords. Consolidating outbound traffic requires holding every upstream credential; being a security boundary is made harder by exactly that.
CVE-2026-42271 lets any holder of a valid proxy key spawn a process on the LiteLLM host through two MCP preview endpoints that carried no role check. GitHub's advisory scores it 8.7 under CVSS 4.0; CISA's KEV entry cites 8.8. Horizon3 chained it with the Starlette host-header bypass CVE-2026-48710 to reach unauthenticated remote code execution and assessed the chain at 10.0. CISA added the LiteLLM flaw to the Known Exploited Vulnerabilities catalog on 8 June 2026. Kestra's flaw is simpler and worse: a suffix match on the request path let any API path ending in configs bypass authentication, scored 10.0.
In the RAGFlow intrusions the attackers placed a Python hook inside the TenantLLM credential-configuration flow, so provider type, model name, API key material and endpoint metadata were captured as administrators configured them. This is not theft of a credential store, it is subscription to the credential store, and it survives a key rotation performed by an administrator who does not know the hook is there. Rotation after a suspected compromise needs to happen after the host is rebuilt, not before, and provider-side revocation matters more than gateway-side replacement.
Censys reported more than 294,000 distinct public IP addresses exposing one of 43 AI and LLM tools, against roughly 183,000 in October 2025. LiteLLM exposure grew 97 percent over that window and Langflow 169 percent, with Langflow accumulating 18 CVEs across 2024 to 2026, of which 14 scored above 8.0 and four reached the KEV catalog. These are internet-scan counts, so they measure reachable services rather than compromised ones. Treat the absolute number as soft and the slope as the finding: the population of internet-reachable AI control planes roughly doubled in ten months.
Least-privilege tool access and activity logging are named as features by all four products examined. Sandboxed execution, infrastructure segregation and documented threat-model scope are named by none. Default-deny networking, human oversight, action scoping and immediate shutdown appear in one or two products and in weakened form. Partial implementations were counted as present, which flatters the middle of the scorecard, so a stricter reading makes the two-of-nine headline worse rather than better.
A gateway proxies a request; it does not own the process that acts on the response. Sandboxing has to happen where the agent's code runs, which for most deployments is a container in someone else's cluster, a CI runner or a laptop the gateway never sees. The row is empty rather than late: it is not a feature the category has failed to build yet, it is one the category is architecturally in the wrong position to provide. Snowflake illustrates the point by shipping a client-side sandbox as a separate component rather than as part of the gateway.
LiteLLM's StandardLoggingPayload captures request messages, the response, the hashed virtual key, team and user identifiers, requester IP and a dedicated mcp_tool_call_metadata structure for tool invocations. What it does not carry is the agent's intermediate reasoning, its planning state, or the causal link between one tool call and the next. It also cannot see anything that did not traverse the gateway: local file writes, direct network calls, subprocess execution. In the documented intrusions the actions that mattered most, reading process environment, writing an SSH key, editing a crontab, hooking a startup path, were all of that kind.
Hugging Face recovered roughly 17,600 attacker actions in about 6,280 clusters spanning 9 to 13 July 2026, reaching pod environment secrets, service-account JWT signing keys, multiple AWS IAM credentials, MongoDB credentials, platform API tokens and mesh VPN keys, with more than 136 secrets from a single cluster object read. Its own account names the foundation of the timeline as the agent's logs on a code sandbox the agent used, retrieved from an external launchpad. Exfiltration was 56 actions out of 17,600, so any detection tuned to spot the exfiltration step gets one chance in three hundred.
Cisco Talos recovered from UAT-10147's infrastructure four AI-generated Python scripts automating a full ViewState exploitation chain, AI-written operational playbooks logging hostnames, IP addresses, exploited paths and extracted MachineKey values, and a target list of roughly 170,000 URLs split across 17 files. The detail that should worry a defender is not the scale, it is the troubleshooting: an operator whose notes record that time-based blind testing failed before pivoting to out-of-band callbacks is running an evaluation loop. Scanning at that volume was always cheap; adapting at that volume was not.
The NCSC's nine areas are threat modelling with documented red lines, action scoping and stop conditions, human oversight, sandboxed execution, default-deny inbound and outbound network, least-privilege tool access, short-lived task-limited per-agent credentials, logging and observability, and immediate shutdown. Two rows are shipped across all four products, and they are the two a routing device can deliver without owning the agent's runtime: decide which tools a caller may reach, and write down what was called. Three rows are addressed by nobody. Documentation is not deployment, and this scorecard should be treated as expired by February 2027 in a category shipping quarterly.
Ships default tool permissions per project and logging of all agent actions. Partial on action scoping through guardrails and request hooks, on human oversight through per-machine approval, on default-deny through inherited tailnet access rules, and on shutdown through revoking a node. Tailnet rules govern who may reach what inside the overlay. The NCSC asks about the agent's egress to the open internet, which is a different control.
Two shipped, four partial, three absent
Ships per-user and per-key read versus write tool permissions, and records every MCP request. Partial on shutdown through token quotas and rate limits. The surrounding positioning is a consistent way to govern agentic AI across hybrid environments, and the quoted executive rationale is that not all tasks should get tokens from the most expensive model. Token quotas and model routing are real value and they are not security controls.
Two shipped, one partial, six absent
Ships fine-grained authorization across MCP servers and an end-to-end record of agent actions. Its client-side sandbox is documented as a separate component of the wider AI security offering rather than as a gateway feature, which is the clearest available evidence that the sandboxing row belongs to the runtime layer and not to the proxy.
Two shipped, none partial, seven absent
Ships permitted tools and RPC calls, plus logs, metrics and traces. Partial on action scoping through prompt guard plugins. Nothing documented on sandboxing, default-deny egress, per-agent credentials, infrastructure segregation, human oversight or immediate shutdown.
Two shipped, one partial, six absent
The row every product leaves empty is the credential one. Short-lived, task-limited per-agent credentials are shipped by none of the four, and that is the same clause an identity vendor is currently arguing the category needs, which is an awkward combination of obvious commercial interest and a substantially correct argument. Every product ships tool-scoping, which is real, and calls it least privilege, while the credential half of the same guidance clause goes unaddressed. That is the pattern to expect from a control list: the market satisfies it by shipping the adjacent feature. A control written as an outcome, such as no credential usable by an agent outlasts the task it was issued for, is harder to satisfy by relabelling than a control written as a capability.
For CISOs, the approval condition worth imposing is specific. Before signing, require the deployment design to name where sandboxing, default-deny egress and per-agent credential issuance are implemented, and confirm that none of the three answers is the gateway. If a team cannot name a different owner for those three, the deployment is not ready regardless of which product was selected. Then treat the gateway as a crown-jewel system from day one: its threat model is closer to a privileged access management vault than to an API proxy, because that is what its database holds. And run the kill-switch test this quarter, because an untested shutdown is not a control and the survey evidence says almost nobody has tried.
For security architects, the gateway is a chokepoint for one protocol, not a boundary. Draw the trust boundary at the process that executes agent decisions, because that is where every action the investigators cared about actually happened, and none of it crossed a gateway. The pattern worth adopting is separating credential custody from request routing: the gateway holds a reference, a broker mints a short-lived credential scoped to one task and one upstream, and compromise of the routing process yields references rather than keys. No product examined ships this, so it is an architecture you assemble. Assume too that the network boundary will be bypassed from inside the trust zone rather than crossed from outside it, because the March 2026 LiteLLM package compromise arrived as a dependency update and executed at interpreter startup, upstream of every egress policy you could write.
For platform engineers holding model credentials, the work is unglamorous. Turn on the configuration audit table, because LiteLLM_AuditLog is disabled by default and its absence is discovered during an incident. Confirm what your gateway keeps in process environment as opposed to a secret store. Keep raw request captures longer than feels reasonable and in a form that can be re-parsed, because the Hugging Face team recovered roughly four times as many secrets by replaying the attacker's own chunked, XOR-encrypted, gzip-compressed decoding as it did by scanning the capture as text. A retention policy that keeps parsed fields and discards raw payloads optimises for storage cost and destroys the artifact that answers the question.
This isn't a vendor summary. Every sentence is labeled by what stands behind it: verified fact, vendor claim, third-party estimate, my assessment, hypothesis, or scenario. Sources are numbered and clickable. Forward-looking sections use scenarios with observable tripwires, not forecasts. It's the same method behind every market assessment I write.
Twenty-five pages, built from public sources with no client brief and no interviews. Read it in the browser or take the PDF.
Each report here answers a real question, directed and researched against public sources and evaluated against a stated assumption, then delivered as Word and PDF. If you're weighing a platform, sizing a category, or defending a number to a board, tell me the decision behind it and I'll tell you honestly whether a report is the right tool.
Commission an assessment