Suspicious Child Processes Spawned by AI Gateway

gaurang k@gaurang7778

•updated Sep 1, 2026•14•0•34

Detects suspicious execution of system commands (curl, wget, python, bash, etc.) by AI/ML-related server processes like LiteLLM, RAGFlow, or Kestra. The detection looks for command-line arguments that may indicate credential harvesting, such as attempts to access environment variables, sensitive database configuration files, or the use of encoded data/network retrieval tools.