OffGuard - Breaking the Most Popular AI Gateway from Auth Bypass to Cloud Compromise

The talk starts with LiteLLM, an open-source AI gateway that holds provider API keys, routes prompts and responses, and connects to tools over MCP. The speaker began by mapping internet-exposed instances and found that roughly one in ten either accepted the default master key or required no authentication at all. That master key also grants admin login and can sign session JWTs, so knowing it exposes much of the deployment.

The middle of the talk covers three attack paths. A guardrail registration endpoint skipped the forbidden-pattern checks and built-in stripping that the test endpoint applied, so custom code ran with root privileges in the container. A pass-through proxy did not validate target URLs, which allowed SSRF to the cloud metadata service. Because the proxy let callers set arbitrary headers, the attacker could complete the IMDSv2 token handshake and retrieve role credentials. A separate MCP authentication handler returned an unrestricted session whenever any Authorization header was present, letting an unauthenticated caller list and execute connected tools. The speaker also reported honeypot captures in which an attacker chained the MCP bypass with another flaw to deploy a crypto miner. The RCE and MCP issues were patched in earlier releases.

The closing advice is to treat AI gateways as high-value infrastructure, rotate default keys, disable MCP when it is not needed, and keep these services off reachable networks even internally. The speaker also argues that teams deploying gateways often skip the review applied to other application endpoints.