Every company racing to deploy AI agents is reaching for the same security tool first, and it's the one they're least equipped to use.
The Summary
- CISA added a LiteLLM gateway flaw to its Known Exploited Vulnerabilities catalog after attackers exploited it to run commands on host systems without credentials — one of seven CVEs disclosed in a single AI gateway in one month
- Most enterprises deploy API gateways as their first AI agent security control, but gateways require identity and attribution layers that don't exist yet
- The real problem isn't theoretical risk, it's sequencing: companies are enforcing agent behavior before they can identify which agent is acting or who authorized it
The Signal
The agent security stack is being built backwards. Companies are deploying enforcement mechanisms before they have the context those mechanisms need to make decisions. It's like hiring a bouncer who can't tell employees from intruders because you haven't issued ID badges yet.
The LiteLLM vulnerability is instructive. Seven CVEs in one month. Attackers chaining flaws to bypass credentials entirely. This isn't a theoretical supply chain risk, it's evidence that the infrastructure layer most companies reach for first is itself immature and attack-prone. The gateway sits on top of identity systems that mostly don't exist for agents yet.
"If the control plane is unaware of which agent is acting, who delegated the work, what task the agent is to perform, and what credentials are being used, then the context is incomplete."
Here's the dependency chain most enterprises are ignoring:
- Identity: Which agent is this, and who created it
- Attribution: Who authorized this agent to act on their behalf
- Task definition: What is this agent supposed to do
- Credential mapping: What access does this agent need
- Gateway enforcement: Block actions that violate policy
Most companies are starting at step five. The gateway can see traffic and apply rules, but it can't distinguish a legitimate finance-reconciliation agent from a compromised one drift-accessing customer PII because both look like authenticated API calls. Without upstream identity context, "technically permissible but operationally inappropriate" actions sail through.
The brownfield problem is harder than the greenfield vision. Security frameworks describe the controls you'll need eventually. They don't tell you how to sequence them when you're already running agents in production, already have an IAM system built for humans, and already face pressure to ship faster. The answer isn't to skip the gateway, it's to stop treating it as the foundation when it's actually the roof.
The Implication
If you're deploying agents, audit your stack in reverse. Start with identity. Can your system differentiate between agents and track lineage back to the human who delegated authority? Can you attribute agent actions to a specific business task? If the answer is no, adding gateway controls is security theater.
The companies that get this right won't be the ones with the most sophisticated gateways. They'll be the ones that built identity and attribution systems for agents before they needed them. That work is unglamorous and slow. It's also the only thing standing between a useful agent workforce and a compliance disaster waiting in your logs.