sk-1234 不是密钥而是文档示例，仍有约 10% 的部署直接照搬

Nearly one in ten internet-facing LiteLLM gateways were running with the literal example admin key from the documentation still active. Not a weak key. Not a leaked key. The key that's printed in tutorials, sk-1234, sitting wide open on the internet, handing out admin access to whoever bothered to try it. Context This isn't new. It's the oldest story in software, wearing an AI costume. Default credentials left in production is a problem older than most people writing about "AI security" right now. Routers, databases, admin panels, IoT devices, we've watched this exact failure mode for two decades. What's different is the blast radius. LiteLLM gateways sit in front of provider API keys, prompt and response logs, and in this case, a pass-through endpoint that could be abused to reach cloud IAM credentials. So the default-password problem, which used to get you a compromised router or a defaced admin panel, now potentially gets you an organization's entire AI cost center and possibly a foothold into cloud infrastructure. Same bug, much bigger stakes, because we bolted this stuff onto cloud IAM without slowing down to think about blast radius. Add in the related CVEs, an MCP authentication bypass and a code execution bug, and Microsoft's confirmation of real-world exploitation with stolen database credentials, and you've got a fully unremarkable vulnerability class producing very remarkable consequences. Hype Check Here's what's being overstated: that this is some novel AI-native attack requiring AI-native defenses. It's not. It's a config hygiene failure. The "AI gateway" branding makes it sound exotic, but swap out "LiteLLM" for "Redis" or "Jenkins" or "Elasticsearch" and you've read this story a hundred times before with the same root cause, same discovery method, same remediation. What's being understated is more interesting: the speed of the deployment cycle. Teams are standing up LLM gateways at a pace that outstrips the pace at which they'd normally do security review on new infrastructure. Nobody would ship a database with a documented default password without at least a passing thought about it. But because this is "AI infrastructure" and everyone's racing to ship AI features yesterday, basic ops discipline got skipped. The urgency narrative around AI adoption is doing real damage here, and it benefits exactly the people telling you to move faster: vendors, leadership under competitive pressure, and yes, researchers who get a nice write-up out of finding the inevitable mess. Also worth noting: 0 points, 0 comments on HN for this story. That silence is its own signal. A default-credential story doesn't get the same attention as a flashy prompt injection demo, even though it's arguably a bigger operational risk right now. Boring bugs don't trend. They just get exploited quietly, which is exactly what happened here per Microsoft's confirmation. Implications If you're running LiteLLM, or any self-hosted AI gateway, go check your admin key right now. Not later today. Now. This is a five-minute fix with potentially catastrophic downside if skipped. For platform and security teams, the bigger lesson is that AI infrastructure needs to go through the exact same hardening checklist as everything else: rotate defaults, restrict network exposure, scan for known CVEs, treat it like the privileged system it is. The fact that it touches LLMs doesn't exempt it from decades-old ops basics. If anything it demands more rigor, because the thing sitting behind that admin key is now your provider API keys, your prompt data, and potentially a bridge into cloud IAM. For the industry more broadly, this is a preview of what's coming. We're deploying a new category of infrastructure (gateways, orchestrators, agent frameworks) faster than the tooling and default-configuration maturity can keep up. Default credentials are just the easiest bug to find. The harder ones, the auth bypasses and code execution paths mentioned in the CVEs, are the ones that don't show up in a Shodan scan and don't make for a tidy headline stat. Open Question When AI infrastructure inherits every classic security failure mode we already knew how to solve, why does the "AI" label keep getting a pass on basic ops hygiene that we'd never tolerate anywhere else? — Cor, Skyblue Soft Sources Nearly 1 in 10 Exposed LiteLLM Gateways Accepted the Example "sk-1234" Admin Key AI-assisted draft or imaging, human-curated, reviewed and edited.