Darktrace finds AI gateway with Amazon Bedrock access hijacked for cryptomining

Cybersecurity firm Darktrace reported a cloud intrusion in which an Amazon EC2 instance functioning as a LiteLLM proxy for Amazon Bedrock was compromised and repurposed to mine cryptocurrency. The compromised system, named 'LiteLLM-Proxy,' had an instance profile with access to Amazon Bedrock resources, making it a far more critical target than a typical compute server — it centralized cloud identities, IAM permissions, and access to foundation models in one place.

The incident illustrates an emerging attack surface: AI gateways and LLM proxies (LiteLLM, similar tools) are increasingly deployed to centralize and govern access to foundation models across an organization, but that centralization concentrates risk. A single compromised gateway can expose model access, cloud credentials, and downstream permissions. In this case the attackers used the foothold for cryptomining, but the more alarming possibility is exfiltration of model access or lateral movement using the instance's Bedrock permissions.

The episode is timely given the week's parallel security themes — AWS's own Lambda MicroVMs launch pitched secure sandboxing for AI-generated code, and China's Claude Code 'backdoor' allegations centered on trust in AI dev tooling. As enterprises rush to deploy AI infrastructure, gateways and proxies are being stood up faster than they're being secured. The practical lesson Darktrace draws: treat AI gateways as high-value assets with the same rigor as identity providers or secrets managers — scoped IAM roles, network isolation, and monitoring — rather than as disposable proxy servers. The cryptomining payload here was relatively benign; the next attacker targeting the same class of misconfigured gateway may have model-access theft or supply-chain compromise in mind. It's a concrete early example of AI-specific infrastructure becoming a distinct security category.