The recent supply chain attack involving Mercor and the LiteLLM vulnerability serves as a massive wake-up call for enterprise security teams. While the security industry has spent the last year fixating on prompt injections and model jailbreaks, this breach highlights a far more systemic vulnerability.

The weakest link in enterprise AI is not necessarily the model itself. It is the middleware connecting the models to your data.

As organizations race to adopt AI, they are relying heavily on proxies, gateways, and Model Context Protocol (MCP) servers to route traffic between their proprietary internal systems and external Large Language Models (LLMs). These integration points form the “Agentic Action Layer.” When an API gateway like LiteLLM is compromised, attackers gain the keys to the kingdom, bypassing the model entirely to access the raw data streams flowing underneath.

The Anatomy of an AI Supply Chain Attack.

Tools like LiteLLM are incredibly popular because they solve a real engineering problem. They act as a universal proxy, allowing developers to standardize API calls across dozens of different LLM providers (such as OpenAI, Anthropic, and Google) using a single, unified format.

However, this creates a highly sensitive, centralized chokepoint. If an attacker compromises this middleware, they do not need to trick the AI model with a clever prompt. Instead, they gain direct access to the API keys, the unencrypted prompts containing proprietary data, and the raw model responses. The attacker can intercept, exfiltrate, or manipulate the data in transit.

This is the stark reality of the Agentic Era. The AI supply chain is fundamentally an API supply chain.

The Blind Spot: Why Legacy Tools Fail Here.

When a third-party proxy or MCP server is compromised, the resulting lateral movement is entirely machine-to-machine.

As highlighted in the newly released 1H 2026 State of AI and API Security Report, organizations are completely unprepared for this architectural shift:

• 60.2% of organizations admit a profound lack of control over the security of the AI models driving their applications.
• 48.9% are essentially blind to non-human, machine-to-machine traffic.

When an attacker hijacks a legitimate AI proxy, legacy Web Application Firewalls (WAFs) and standard API gateways fail completely. These tools are designed to inspect inbound external traffic from human users. They are architecturally blind to internal machine identities communicating with external LLM endpoints.

To a legacy WAF, a compromised LiteLLM server exfiltrating data looks exactly like a legitimate AI workload executing a scheduled task.

Securing the Middleware with the Salt Agentic Security Platform

To defend against these next-generation supply chain attacks, organizations must secure the Agentic Action Layer. You cannot secure an infrastructure you cannot see, and you cannot rely on static signatures to catch compromised machine identities acting maliciously.

The Salt Agentic Security Platform neutralizes these proxy breaches through two purpose-built capabilities:

1. Agentic Security Posture Management (AG-SPM) and the Security Graph. To prevent vulnerable middleware from exposing your enterprise, you must first map it. Salt builds a dynamic Agentic Security Graph that continuously maps the multi-pronged relationships between LLMs, external proxies, MCP servers, and foundational APIs. By scanning repositories and runtime environments, Salt identifies risky third-party LLM integrations and uncovers “Shadow AI” infrastructure. If developers spin up an unauthorized or vulnerable LLM proxy, AG-SPM flags it before it can be weaponized by an attacker.

2. Agentic Detection and Response (AG-DR) via Intent Analysis. Even with perfect posture, zero-day supply chain vulnerabilities will occur. When middleware is compromised, security teams need to detect anomalous behavior instantly. Salt AG-DR establishes agentic-aware baselines for all LLM connectivity. It performs Identity-Aware Intent Analysis, correlating 100% of traffic back to the specific machine identity (in this case, the LiteLLM proxy).

If that proxy suddenly begins routing traffic to an unauthorized external IP address or executing massive data pulls that fall outside its expected behavior, Salt recognizes the malicious “Sequence of Intent.” The platform immediately interrupts the machine-speed attack and automatically triggers blocking actions, stopping data exfiltration in its tracks.

The Takeaway

The Mercor and LiteLLM incident is not an outlier; it is a preview of the new attacker playbook. Securing AI innovation requires more than just sanitizing prompts. It requires absolute visibility and behavioral control over the API supply chain that connects your data to the models.

If you want to learn more about Salt and how we can help you, please contact us, schedule a demo, or visit our website. You can also get a free API Attack Surface Assessment from Salt Security’s research team and learn what attackers already know.

*** This is a Security Bloggers Network syndicated blog from Salt Security blog authored by Eric Schwake. Read the original post at: https://salt.security/blog/the-ai-supply-chain-is-actually-an-api-supply-chain-lessons-from-the-litellm-breach