Memorandum
- From
- Caroline Mercer via VentureBeat
- Date
- Filed
- Business·5 min to read
- Re
AI agent security experts warn gateways are not the first control to deploy
ReAI agent security experts warn gateways are not the first control to deploy
Enterprises are rushing to deploy AI gateways as their first security control, but experts warn this approach is flawed. Identity, attribution, and inventory must come first, as gateways alone cannot distinguish justified actions from inappropriate ones, leaving agents vulnerable to drift, data exposure, and memory poisoning.
Enterprises racing to secure their AI agents are making a costly mistake by treating the gateway as the first line of defense, according to a new analysis of production agent deployments. The gateway, which sits at the network edge and filters traffic between agents and applications, is being deployed before the identity and attribution layers it depends on are in place, leaving organizations exposed to data leaks, unauthorized actions, and compromised agents.
The risk is not hypothetical. In June, the Cybersecurity and Infrastructure Security Agency added a flaw in LiteLLM, a popular AI gateway, to its Known Exploited Vulnerabilities catalog after attackers were found abusing it in the wild. That bug allowed attackers to run commands on the host through the gateway itself, and when chained with a second flaw, required no credentials at all. It was one of seven vulnerabilities disclosed in that single AI gateway in a single month.
The core problem is that gateways authenticate tokens and check API calls, but they cannot observe the full context of an agent's actions. A finance-reconciliation agent, for example, might attempt to alter a record in production. The gateway authenticates the user token and checks the API call. What it cannot see is that the request is agent-initiated, that the agent is executing a more limited function than the human principal, or that the request is part of a tool chain invoked by an untrusted artifact. The credential is valid. The API call is permissible. But the action contradicts the purpose of the delegation.
Security experts describe this as a dependency chain, where each control depends on context generated upstream. Enforcement is being taken early, while the identity and attribution context it depends on has yet to be developed. The result is that a costly control is applied to a very small part of the whole picture, and the gateway struggles to distinguish a justified action from one that is technically permissible but operationally inappropriate.
The recommended approach, called dependency-gated deployment, sequences six controls in a specific order. First, organizations must build an agent inventory with accountable ownership, recording the owner, purpose, approved tools, and lifecycle state for every production agent. Second, each agent needs a distinct identity plus delegation context, identifying the agent, its owner, and the principal it is acting for. Third, credentials should be task-scoped and short-lived, so a compromised agent cannot reach resources unrelated to its assigned task. Fourth, telemetry must be attributable, allowing a completed task to be reconstructed from initiation to downstream effect. Fifth, runtime action enforcement should incorporate agent, principal, task, and action context, not just token validity. Sixth, behavioral baselines and a cross-system kill path must be established so an agent's effective authority can be stopped everywhere it reaches.
Limiting an agent's privileges to those of the human principal is useful, but it does not create separate attribution. Twenty agents might operate under a single person's permissions and still need unique identities, audit logs, behavior profiles, and revocation paths. Without that separation, downstream logs attribute every action to the employee whose token was borrowed, and every action is attributed to someone who did not start it.
The first step is to recognize the production agents already running in open-source frameworks, cloud offerings, SaaS services, and developer tools. For each, organizations should record the owner, responsibility, lifecycle stage, allowed tools, data domains, and sources of credentials. Bypassing this step means losing the first hour of incident response while figuring out what should have been obvious. The inventory identifies the asset that every control thereafter governs.
