One in Ten AI Gateways Is Guarded by the Password From the Manual
Nearly one in ten internet-facing LiteLLM gateways still accept the example admin key from the docs. It is not a bug story. It is the security debt of the entire AI buildout — and a market waiting for its first named breach.
Every enterprise on earth is racing to bolt generative AI onto its business. To do it cleanly, most of them put a piece of software called an AI gateway in the middle — a single control point that sits between a company's applications and the dozens of model providers it pays for. The gateway holds all the API keys, meters usage, enforces budgets, logs every prompt, and hands developers one clean interface instead of ten.
It is exactly the kind of unglamorous plumbing that gets deployed fast, by whoever needs it, in the rush to ship an AI feature before the competitor does. And that is the problem.
On September 9, cloud security firm Wiz published research on LiteLLM — the most popular open-source AI gateway, present in roughly one-third of all cloud environments by Wiz's own telemetry. What they found is the kind of thing that should stop a CISO cold: of the roughly 3,074 internet-facing LiteLLM servers they scanned, 9.6% — nearly one in ten — accepted sk-1234, the example admin key printed in LiteLLM's own setup guide, or required no authentication at all.
Not a clever exploit. Not a zero-day. The literal placeholder password from the documentation, still live in production, wide open to anyone on the internet who thought to try it.
What a single default key actually unlocks
The reason this matters more than a typical misconfiguration is what that one credential controls. The master key on an AI gateway does two jobs at once: it is the administrator login and the switch that turns authentication on in the first place. On older versions, a gateway that started with no master key set simply granted every incoming request full admin rights.
An admin on one of these boxes is not looking at a limited blast radius. The gateway holds a working API key for every model provider it routes to — OpenAI, Anthropic, AWS Bedrock, Azure, Google Vertex. It sees every prompt and every response flowing through the company. It can reach internal tools wired in through the Model Context Protocol. And it typically runs with the cloud permissions of the workload it lives in.
The cheapest form of abuse is LLMjacking — stealing the provider keys and running your own model workloads on the victim's bill. Wiz went further and showed a chain that walks from the gateway's default key all the way out to the cloud account's IAM credentials, by pointing one of LiteLLM's own pass-through routes at the instance metadata service. Microsoft, separately, published a real August case: attackers ran commands inside a live LiteLLM gateway, read the master key and provider keys straight out of the container's environment, pulled the database connection string, and copied records out of the underlying PostgreSQL database.
Briefings like this land in members' inboxes before the market prices them in. Join free →
This is not a LiteLLM story
It is tempting to file this under "one open-source project shipped a bad default." That misreads it. The default key is the symptom. The disease is the speed and the sprawl of the AI buildout itself — the same dynamic that produced the shadow-IT and unmanaged-cloud problems of the last decade, now replaying at AI pace with far higher-value credentials sitting behind each door.
One flaw from the same research, CVE-2026-59822 — an authentication bypass that lets an attacker open a valid session with any bearer token, including one a single character long — has already been added to CISA's Known Exploited Vulnerabilities catalog, with a federal patch deadline. Wiz watched it get probed against its honeypots starting in July. A separate, older LiteLLM flaw was seen being chained to install a cryptocurrency miner. The attackers are not waiting for the whitepapers.
So the question for anyone allocating capital around the AI theme is not "is LiteLLM safe." It is: what is it worth to secure an attack surface that every large enterprise is now building, mostly without a security team in the room — and who gets paid to do it?
The rest of this briefing is free — it just requires a free AlphaBriefing account: the four public names positioned to capture AI-security spend, the three catalysts that turn this from a slide into revenue, and the bottom-line framework for how to actually play it.
Create your free account → — 30 seconds, no card.