The collapse of the exploit window has become a defining characteristic of modern infrastructure compromise, and artificial intelligence platforms now sit at the center of this acceleration. When a critical vulnerability in LiteLLM’s database query handling was disclosed in late April, threat actors moved to exploitation within thirty-six hours. When LMDeploy’s server-side request forgery flaw became public, the window shrank to thirteen hours. The pattern is consistent across targets: disclosure, indexing in public databases, and weaponization before most organizations have deployed patches.

Current AI infrastructure attacks differ from earlier exploitation waves in one key respect: adversaries know exactly what they’re looking for. The LiteLLM attacker didn’t probe user tables or audit logs. They went straight for credential storage and runtime configuration tables, extracting upstream API keys for OpenAI, Anthropic, and AWS Bedrock in two coordinated phases from adjacent IP addresses. This wasn’t reconnaissance—it was surgical extraction by an operator who understood the data model before making first contact.

The speed has structural causes. Advisory formats designed for transparency now function as exploit templates. When GitHub publishes the affected file, parameter name, root cause, and sample vulnerable code, any commercial large language model can generate working exploit code from the advisory text. The LMDeploy vulnerability disclosure included enough technical detail that an attacker with no prior familiarity could port-scan AWS metadata services, Redis, and MySQL instances across an eight-minute session, switching between vision-language models to evade basic detection.

Organizations running AI inference servers, model gateways, and agent orchestration tools face exposure that extends well beyond the applications themselves. A single compromised LiteLLM credential row often holds keys with five-figure monthly spend caps and workspace admin rights across multiple cloud providers. The blast radius resembles a cloud account compromise more than a traditional web application breach. When Hugging Face’s LeRobot platform was found to deserialize untrusted network input using Python’s unsafe pickle format, the irony was impossible to miss: the same organization that created Safetensors specifically to avoid pickle’s dangers had deployed it in a robotics framework designed to run with elevated privileges near expensive compute resources and sensitive datasets.

But we shouldn’t overstate how novel the underlying problems are. Most vulnerabilities disclosed in April are textbook failures: missing input sanitization, unsafe deserialization, SQL injection through string concatenation. GitHub’s CVE-2026-3854, exploitable with a single git push command, stemmed from inadequate sanitization of user-supplied push options before inclusion in internal service headers. The company deployed a fix to GitHub.com within two hours of validation, and no evidence of malicious exploitation has surfaced. The core engineering failures aren’t new. What has changed is the operational tempo and the value concentration in the targets.

Federal agencies remain exposed to the same dynamics, though with regulatory backstops that don’t exist in the private sector. When CISA added four vulnerabilities to its Known Exploited Vulnerabilities catalog in late April, the agency gave Federal Civilian Executive Branch agencies a May 8 deadline to remediate or discontinue use. The flaws included command injection in end-of-life D-Link routers, path traversal in SimpleHelp and Samsung MagicINFO servers, and missing authorization controls that allowed privilege escalation to server admin roles. Two of the SimpleHelp vulnerabilities had already been exploited as precursors to ransomware attacks attributed to the DragonForce operation. That regulatory requirement to patch or disconnect provides a forcing function absent in most sectors.

Healthcare organizations face the same exploitation risks without the same enforcement structure. The Office for Civil Rights settled four ransomware investigations in April involving over 427,000 affected individuals—a reminder that the consequences of infrastructure compromise land on patients and providers, not just balance sheets. The settlements followed breaches enabled by the same class of failures: unpatched vulnerabilities, inadequate access controls, and insufficient network segmentation.

For security decision-makers, the lesson isn’t that AI infrastructure is uniquely vulnerable, but that it has become uniquely valuable and uniquely fast to exploit. The FIRESTARTER backdoor, deployed on a federal Cisco Firepower device and capable of surviving firmware updates and security patches, demonstrated persistence through manipulation of boot sequences. The malware hooks into the LINA process, enabling arbitrary shellcode execution through crafted WebVPN authentication requests. It survives because it lodges itself into startup mount lists before the device fully initializes.

Investment priorities need to shift from perimeter defense to rapid detection and containment. The window for preemptive patching has compressed to the point where it no longer exists for many organizations. Assume breach. Instrument runtime environments. Segment credential storage. Treat AI inference servers and model gateways as crown jewels, not middleware. The adversaries already do.