AI agent security risks: Gateways alone are insufficient

AI agents, even those that pass initial authentication, remain susceptible to significant security risks. VentureBeat's analysis highlights that the commonly adopted gateway approach is often insufficient. This is primarily because gateway security relies on underlying identity and attribution layers, which are frequently underdeveloped or absent in enterprise deployments.

A stark example of this vulnerability emerged when CISA added a flaw in LiteLLM to its Known Exploited Vulnerabilities catalog. Attackers were actively exploiting this bug, which allowed command execution on the host through the gateway itself. Combined with another vulnerability, it required no credentials for exploitation, demonstrating a critical failure in layered security.

Industry experts advocate for a phased approach to agent security, positioning gateway controls as the fifth layer, not the first. The critical issue lies in correctly sequencing these controls, especially in existing 'brownfield' environments. A robust security framework requires not just a gateway, but also comprehensive identity management, attribution context, task-specific credentials, traceable telemetry, runtime enforcement, and behavioral monitoring.

Without clear context—knowing which agent is acting, who delegated the task, the specific operation, and the credentials used—security controls are limited. A gateway might block overt policy violations but struggles to differentiate legitimate actions from operationally inappropriate ones that are technically permissible. Effective agent security functions as a dependency chain, where each control relies on information generated upstream from prior layers.