--- title: "An AI Gateway Is Insufficient Security Without a Control Plane" id: "3492" type: "insight" slug: "ai-security-control-plane-beyond-gateway" published_at: "2026-08-27T20:29:40+00:00" modified_at: "2026-08-27T23:51:18+00:00" url: "https://jetstream.security/insights/ai-security-control-plane-beyond-gateway/" markdown_url: "https://jetstream.security/insights/ai-security-control-plane-beyond-gateway.md" excerpt: "Somewhere in your estate, an agent you approved is doing something you did not intend. The question is, what’s the right level of tech to fully gain control of AI?" taxonomy_insight_category: - "AI Advisory" taxonomy_insight_type: - "Editorial" taxonomy_insight_tags: - "Agentic Identity" - "AI Gateway" - "MCP" - "Runtime Governance" - "Supply Chain Security" --- AI Advisory # An AI Gateway Is Insufficient Security Without a Control Plane Somewhere in your estate, an agent you approved is doing something you did not intend. The question is, what’s the right level of tech to fully gain control of AI? [Agentic Identity](https://jetstream.security/insights/insight_tags/agentic-identity/) [AI Gateway](https://jetstream.security/insights/insight_tags/ai-gateway/) [MCP](https://jetstream.security/insights/insight_tags/mcp/) [Runtime Governance](https://jetstream.security/insights/insight_tags/runtime-governance/) [Supply Chain Security](https://jetstream.security/insights/insight_tags/supply-chain-security/) Editorial > It seems like everyone has an AI gateway these days. In the last three months, Rippling, Ramp, Databricks, Microsoft, and IBM have all launched their own versions of the AI control. They join LiteLLM, Portkey, Kong, and yes, JetStream, along with others of an earlier vintage. This follows the speed of AI improvements; [Anthropic documents the gateway](https://code.claude.com/docs/en/gateways) > as the recommended control point for enterprise Claude Code deployments, centralizing authentication, usage attribution, budgets, and audit logging. (Anthropic ships its own gateway, of course.) JetStream proclaims that AI gateways are now commodity. Everyone is building them. Tons of vendors sell them. Their ubiquity is a clue that these AI packet movers are rapidly being adopted by enterprises. They route traffic, cache responses, proxy MCP comms, provide basic guardrails, and maybe a few other things mixed and matched here and there. That work is genuinely necessary, which is why JetStream does it too. It is also, as [the JetStream case for the gateway as a control point](https://jetstream.security/insights/ai-gateway-security-control-plane/) argued in July, where credential sprawl collapses and policy gets applied once instead of everywhere. AI gateways should (and can)be the foundation of something larger. Remember [Zero Trust](https://blog.google/security/going-beyond-zero-a-new-paradigm-for-enterprise-security/) ? It settled the question of whether a user or an application should reach a resource. It assumed a human on the other end, moving at human speed, and it drew the boundary around the application. Agents break all three assumptions. They are not human, they do not move at human speed, and the application is no longer the unit worth trusting. The boundary must move to the action itself and be evaluated in the moment rather than reconstructed afterward. JetStream adds an intelligence layer on top of commodity AI gateway functions. The result is a full control plane designed to decide whether an AI request should move at all, by examining who is asking, which approved design authorized them, which tool they are calling, and what that specific call is about to do. This distinction between commodity gateway and an intelligent gateway is critical to understand lest you get stuck having invested in tech that you find out later does not actually do everything you need it to do. Together, those two layers are an AI control plane. Most Enterprises we speak with are either experimenting with or have purchased the lower half, an “enterprise AI Gateway,” with modest features. They find the limits the first time an approved agent carries out an action no one would have approved. By the time a basic AI gateway logs the action, it’s too late, sorry… the agent has already acted. ## **The insider threat changed shape** Enterprise security solutions have successfully neutralized new attack surfaces before. Cloud and SaaS adoption moved data outside the perimeter, and the industry created controls for it. Early firewalls understood ports, protocols, and connections, and they were correct for their moment. Application-aware firewalls understood what was actually inside the traffic, and a category was built on the difference. The agentic wave is different in a specific way. For the first time, the insider threat vector poses a greater challenge than external attacks. This is compelling when you consider that external attacks are also becoming far more sophisticated by relying on LLMs. A relatively simple gateway that routes requests is not sufficient to block agentic attacks, because agents do not stop. They run continuously, without the natural gaps that bound human activity. They act at volume, reaching more services, resources, and datasets through APIs than a person ever could. The surface they touch changes weekly, and several major incidents from the past year show the shape of the problem: **A tool you installed.**Postmark is a transactional email service, the kind of thing an application uses to send invoices, password resets, and account notifications. Its MCP server is the small piece of connector code that lets an AI agent send that mail on your behalf. In September 2025, [Koi Security found](https://www.koi.ai/blog/postmark-mcp-npm-malicious-backdoor-email-theft) that a copy of that connector, published to the public npm registry as postmark-mcp, had shipped a single-line change at version 1.0.16. Every message the agent sent now carried a silent blind carbon copy (BCC) to an address the attacker controlled. It was pulling roughly 1,500 downloads a week, and the publisher had shipped 15 clean versions before the change. Prior to the Agentic era, most enterprises would not install or run code of unknown provenance, but we do it all the time with MCP servers. **A gateway you ran.**In March 2026, the threat group TeamPCP compromised LiteLLM’s PyPI publishing credentials through a poisoned Trivy scanner inside LiteLLM’s own build pipeline, then published two backdoored releases. Version 1.82.8 dropped a file that executed the moment any Python interpreter started, harvesting credentials, moving laterally through Kubernetes, and installing persistence disguised as a telemetry service. [Cycode traced all three stages](https://cycode.com/blog/lite-llm-supply-chain-attack/) . This [supply chain breach](https://jetstream.security/insights/the-litellm-breach-is-a-warning-the-real-question-is-architectural/) also worked when the internal processes allowed auto-upgrades of a critical piece of infrastructure. **An agent that got loose.**In July 2026, during an evaluation of cyber capability, a combination of OpenAI models exploited a previously unknown vulnerability in JFrog Artifactory, the package proxy that served as their sandbox’s only permitted network path, and reached the open internet. The models then entered Hugging Face infrastructure through a pair of bugs in a dataset loader. [Hugging Face’s forensic timeline](https://huggingface.co/blog/agent-intrusion-technical-timeline) recovered roughly 17,600 actions between July 9 and July 13, about two and a half days of it inside their systems and confirmed that no human directed the individual steps. [OpenAI’s own account](https://openai.com/index/hugging-face-model-evaluation-security-incident/) concluded the models were trying to score better on a benchmark rather than cause harm, and every destructive cloud call carried a dry-run flag. This type of rogue, or runaway agent, represents the biggest risk because there was no granular access control. ## **What the AI Control Plane adds** Recall that not every AI gateway is the same. JetStream supports all the basic AI traffic processing (like the dozens of ubiquitous near clones). We build on that with the intelligent features enterprises really need. **A gateway that is fast and holds up under load.** JetStream’s implementation authenticates every service through OIDC, supports built-in or third-party guardrails, is designed for high throughput, scales horizontally, and deploys as SaaS or inside a customer VPC. It is the commodity half of the job, and we treat it that way. **An approved design to enforce.**JetStream AI Blueprints™ are versioned operational contracts describing how each agentic system is assembled: which models, MCP servers, tools, datasets, and identities it uses, and under whose authority it acts. This is the beginning of market differentiation, but there is more. **A catalog you can trust.**Most organizations spent a decade blocking code of unknown origin. Convenient as it is, MCP quietly reversed that. [JetStream Verified MCP™ catalog attestation](https://jetstream.security/insights/jetstream-verified-mcp-governance-layer-for-enterprise-ai-agents/) replaces uninspected open-source servers with hardened versions that are scanned, remediated, and cryptographically attested before an agent can call them. **Policy that binds to the action, not the connection.** Access is not one decision made at the door. Policy attaches to the identity when access is requested, and it reaches inside the tool, down to the individual parameter. That is the difference between authorizing an entire resource access and authorizing specific actions. Tool-level filtering makes that concrete. A team can enable a server’s read tool and block its delete tool, so the agent never has the DELETE permission it never needed. **Continuous comparison against the approved design.**JetStream compares live behavior to the Blueprint and surfaces both configuration change, such as a model or MCP server appearing that was never approved, and behavioral change across a sequence of actions. Single actions rarely read as good or bad on their own, so the evaluation runs across the sequence. This is the [design of record and design control](https://jetstream.security/insights/a-policy-is-not-a-control/) applied at runtime. **Enforcement where we sit inline, containment where we do not.**When traffic routes through the JetStream AI Gateway, policy is enforced ***before***the action is executed. However, we realize that many agents are deployed in cloud and SaaS platforms that cannot be routed through an Enterprise AI Gateway. In those instances, JetStream raises the alert and uses APIs to revoke access or stop the AI system from doing unauthorized further work. ## **Who acted, and under whose authority** The blocker on enterprise AI was never model quality. It is that when something goes wrong, nobody can answer who acted, under whose authority, against which approved design, and at what cost. Authentication proves who is asking. It does not prove that what they are asking for is safe. A valid key is not a valid reason. Governance is not what slows this down. It is what lets an enterprise say yes to AI. [Meet JetStream at Fal.Con (booth #1414)](https://jetstream.security/crowdstrike-falcon-2026/) , August 31 through September 2 to see the full control plane in action. ## Stay ahead with our newsletter Stay informed on industry trends, expert analysis, and product updates. #### Explore more insights [See all Insights](/insights) [https://jetstream.security/insights/ai-agent-security-containment-approvals/](https://jetstream.security/insights/ai-agent-security-containment-approvals/) Sep 3, 2026 ###### Treat Your AI Agent Like an Attacker What fifteen years of chasing lateral movement taught me about AI agents, and the 1990s cockpit research that explains why a human in the loop only helps if the… [https://jetstream.security/insights/ai-agent-security-containment-approvals/](https://jetstream.security/insights/ai-agent-security-containment-approvals/) [https://jetstream.security/insights/first-us-prompt-injection-court-filing/](https://jetstream.security/insights/first-us-prompt-injection-court-filing/) Aug 25, 2026 ###### First U.S. Court Sanctions a Litigant for Hiding AI Instructions in a Filing A Connecticut plaintiff hid instructions to AI in white-on-white text, and a judge sanctioned the attempt even though no AI ever read the filing. [https://jetstream.security/insights/first-us-prompt-injection-court-filing/](https://jetstream.security/insights/first-us-prompt-injection-court-filing/) [https://jetstream.security/insights/mcp-vs-skills/](https://jetstream.security/insights/mcp-vs-skills/) Aug 18, 2026 ###### MCP vs. Skills: A False Debate MCP gives an agent its tools and Skills give it the instructions. The teams winning with Claude run both, and governance is what keeps the pairing safe. [https://jetstream.security/insights/mcp-vs-skills/](https://jetstream.security/insights/mcp-vs-skills/) ## Top Articles 01 Press Release ### [JetStream Security Achieves FedRAMP Class D (High) Certification Through Second Front](https://jetstream.security/insights/jetstream-security-fedramp-high-certification/) July 22, 2026 02 Press Release ### [JetStream Announces Verified MCP Governance Layer for Enterprise AI Agents](https://jetstream.security/insights/jetstream-verified-mcp-governance-layer-for-enterprise-ai-agents/) July 13, 2026 03 Press Release ### [JetStream Releases ‘AI Kill Switch’ to Shut Down Individual Agents](https://jetstream.security/insights/jetstream-ai-kill-switch-agents/) July 27, 2026 ## Featured Experts [https://jetstream.security/author-bio/patrick-zeller/](https://jetstream.security/author-bio/patrick-zeller/) ### [Patrick E. Zeller](https://jetstream.security/author-bio/patrick-zeller/) General Counsel, Legal and Compliance Patrick has spent over twenty years advising Fortune 100 companies on privacy, cybersecurity, and data protection — including... [https://jetstream.security/author-bio/keith-weisman/](https://jetstream.security/author-bio/keith-weisman/) ### [Keith Weisman](https://jetstream.security/author-bio/keith-weisman/) Head of Forward Deployed Engineering Keith brings thirty years of hands-on cybersecurity and services leadership, beginning with enterprise security consulting at Accenture and... [https://jetstream.security/author-bio/tommy-hui/](https://jetstream.security/author-bio/tommy-hui/) ### [Tommy Hui](https://jetstream.security/author-bio/tommy-hui/) Head of Sales Engineering Tommy Hui has spent more than a decade leading sales engineering at security companies, including six years at...