Security teams are deploying LLM pipelines, retrieval-augmented generation (RAG) stacks, and AI orchestration frameworks at a pace that outstrips their ability to secure and monitor them. LangChain applications with API keys in .env files. Vector databases (Pinecone, Milvus, ChromaDB, Weaviate) holding embeddings of proprietary documents. Model staging servers with GPU access pulling weights from Hugging Face. None of this has the telemetry architecture that a standard web application would.

The threat is not hypothetical. APT28's LAMEHUG malware integrates LLM capabilities for automated reconnaissance. Prompt injection attacks against public-facing LLM endpoints can extract system prompts, API keys, and internal data. Adversaries targeting vector databases can exfiltrate the proprietary training data that represents an organization's competitive advantage.

1. 1. Inventory all AI/LLM infrastructure Most security teams don't know what AI infrastructure exists. Audit for: LangChain/LlamaIndex/AutoGen deployments, vector database instances, GPU compute nodes running model inference, API endpoints serving LLM completions, and developer notebooks (Jupyter) with model access. You can't secure what you haven't inventoried. Asset inventory · Container registry audit · Cloud resource tags for ML/AI workloads
2. 2. Hunt for API token and credential exposure LLM applications store API keys (OpenAI, Anthropic, cloud provider credentials, database connection strings) in .env files, environment variables, and application configs. Search for: .env files in production containers and repos, hardcoded API keys in application code, and secrets committed to version control. A single exposed API key can cost thousands in compute or grant access to internal systems. Kubernetes (container secrets) · macOS Fleet (developer credential files)
3. 3. Monitor for prompt injection against public-facing LLM endpoints If your organization exposes an LLM-powered chatbot, search tool, or API, it is a prompt injection target. Search application logs for: inputs containing "ignore previous instructions," system prompt extraction attempts, requests attempting to make the LLM call external URLs or APIs, and inputs designed to extract training data or RAG context. Prompt injection is the SQL injection of AI applications. Application logs: input/output logging on LLM endpoints · WAF rules for injection patterns
4. 4. Check for anomalous bulk queries to vector databases Vector databases hold embeddings of proprietary documents, customer data, and internal knowledge. Bulk similarity searches or direct API access patterns that don't match normal application usage may indicate data scraping for exfiltration. Search for: query volume spikes, queries from unexpected source IPs, and API access from non-application service accounts. Vector DB access logs · API gateway: query volume analysis · Data Exfil
5. 5. Verify model integrity and supply chain Models pulled from public repositories (Hugging Face, GitHub) can contain backdoors, trojans, or malicious code in custom layers. Search for: models loaded from unverified sources, pickle files (Python serialization, arbitrary code execution risk), and model files that have been modified since initial deployment. Treat model files like executable code. Supply Chain playbook · Model hash verification · Pickle scanning
6. 6. Audit MCP server and tool-use configurations AI orchestration frameworks (LangChain, AutoGen, MCP servers) grant LLMs the ability to call external tools, execute code, query databases, and access APIs. Audit for: over-privileged tool configurations, MCP servers with unrestricted network access, agents with write access to production systems, and tool-use logs showing unexpected external calls. MCP server configs · Tool-use audit logs · Agent permission review

Kubernetes and Container (LLM infra often runs on K8s)
Cloud Control Plane (AI services run on cloud with shared IAM)
Supply Chain Indicator (model and package supply chain)
APT28 (LAMEHUG LLM-enabled malware)