The thing that routes your AI requests just sold for a reported $7.5 billion. The free alternative has been on CISA's actively-exploited list three times this year.

Somewhere between 2024 and now, a new piece of plumbing quietly installed itself in almost every business that builds anything with AI. It has no user interface, nobody outside the engineering team can name it, and it sits directly between your application code and every model provider you pay.

It is called an AI gateway, and this year it has become the most interesting single point of failure in a small company’s stack.

Two things happened to it recently. In August, Stripe agreed to buy OpenRouter, the largest neutral hosted gateway, at a price reported between $7 billion and $8 billion. And on September 2, CISA added LiteLLM, the open-source gateway most teams self-host, to its Known Exploited Vulnerabilities catalog for the third time in four months.

Those two stories are usually filed in different sections. They are the same story. The routing layer became load-bearing, and now everyone who wants it, from payment companies to ransomware crews, is turning up.

What an AI gateway actually is

Skip this if you already know. If you do not, it is worth ninety seconds, because the decision below is unmakeable without it.

When your software talks to a model, the naive version is one API key pointed at one provider. Your code calls Anthropic, or OpenAI, or Google, directly. That works and it is what most small deployments do.

A gateway sits in the middle. Your code calls the gateway with one API key and one request format, and the gateway decides which actual model gets the request. That buys you four things:

• Fallback. When a provider has an incident, requests move to another model instead of returning errors to your customers.
• Cost routing. Cheap models handle the easy work. Expensive ones handle the hard work. You do not hand-code that decision in a hundred places.
• One bill and one budget. Spend caps, per-team keys and usage reporting across providers instead of five separate consoles.
• No lock-in, in theory. Swapping a model becomes a config change rather than a rewrite.

That fourth one is why the category exists. As TechCrunch put it in May, “the multi-model future is already here,” and companies are building this way specifically to avoid betting the business on one lab.

The catch is the obvious one. To get those four benefits, every prompt your business sends and every answer it receives now passes through one component. If that component is somebody else’s service, it sees everything. If it is your own server, it is your responsibility. There is no third option where the traffic goes through nothing.

What Stripe actually announced, versus what got reported

On August 19, 2026, Stripe announced it had agreed to acquire OpenRouter. Both words matter, and most of the coverage dropped the second one.

Here is Stripe’s release, in full, on the substance:

Stripe, the programmable financial services company, today announced that it has agreed to acquire OpenRouter, a leading AI model gateway and routing platform. OpenRouter helps businesses route and optimize token usage across 400+ models from more than 80 providers.

And here is OpenRouter’s own post the same day:

The transaction is subject to customary closing conditions. We expect to close in the coming weeks.

As of today, September 8, Stripe’s newsroom headline still reads “Stripe agrees to acquire OpenRouter.” A number of outlets have run headlines saying the deal closed in mid-August. It was announced in mid-August. Those are different events, and if you are making a vendor decision on the strength of this, the distinction is the whole point: nothing is final until it is.

A few other numbers are being repeated more confidently than the sourcing supports.

The price. Stripe disclosed no terms. Bloomberg reported more than $7 billion on August 16. TechCrunch and Payments Dive both cite $7.5 billion with $1.5 billion going to the founders, attributed to the New York Times. Other outlets cite $8 billion attributed to the Financial Times. Every figure in circulation is reporting, not disclosure. The one thing that is documented is the comparison: OpenRouter closed a $113 million Series B at a $1.3 billion post-money valuation in May 2026, led by Alphabet’s CapitalG. Against that, the reported prices are a multiple of roughly 5.4 at $7 billion, 5.8 at $7.5 billion and 6.2 at $8 billion, three months later. You will see “5.4x” quoted alongside the $7.5 billion figure in several write-ups. Those two numbers do not go together. 5.4 is the multiple on Bloomberg’s “more than $7 billion,” and if the $7.5 billion price is the right one then the multiple is closer to 5.8.

The token volume. You will see “more than 10 trillion tokens per day” in a lot of the coverage. It is not in Stripe’s announcement, which contains no token figure at all. We could trace it to two places. TechCrunch reported 100 trillion tokens per month in late May, roughly 3.3 trillion per day, itself a fivefold increase over six months. Menlo Ventures, an OpenRouter investor, published a “4.5+ quadrillion-token annual run rate” on the day of the announcement, which works out to about 12.3 trillion per day, and said volume doubles every eleven weeks.

Those reconcile, roughly. Take TechCrunch’s 3.3 trillion a day in late May, apply the investor’s own eleven-week doubling over the twelve weeks to August 19, and you land near 7 trillion a day. The 10 to 12 trillion figures are at the optimistic end of the company’s published growth curve rather than outside it. They are also coming from the seller’s side of the table, which is worth remembering when they get quoted back to you as neutral market data.

The model count. Stripe says “400+ models from more than 80 providers.” Menlo and several outlets say “over 500 models.” Both are current claims about the same platform, made three months apart by parties with different incentives. Use Stripe’s, since Stripe is the one buying.

Why a payments company paid this much for a router

Stripe’s stated reasoning is that tokens are becoming a line item that businesses need managed the way payments are managed. From the release:

Tokens are the central currency for companies building with AI, and it’s clear that the real-world economic potential will depend on making good use of scarce compute resources.

That is Patrick Collison, and it is more literal than it sounds. Stripe already sells Token Billing, a product for charging customers based on AI usage. It knows what businesses charge for AI. Buying OpenRouter tells it what businesses pay for AI. Owning both ends of that is a genuinely defensible position, and it explains a price that made the Hacker News thread openly incredulous. The top comment there: “$7B is higher than the market caps of Lyft, Dolby, and Alaska Airlines. Why is an API middleman worth this much money?”

The answer that makes the most sense is not the routing code. It is the dataset. Menlo’s argument is that OpenRouter has accumulated “one of the most expansive datasets of prompts, models for those prompts, contexts around those tasks, and the final results.” A router that has watched several quadrillion tokens knows which model is actually best for which job, at which price, better than any published benchmark does. That is hard to rebuild and it compounds.

Which brings us to the part that matters if you are the customer.

OpenRouter’s entire value proposition is neutrality. It has been explicit about that, before and after the deal. Alex Atallah, in Stripe’s release:

Developers need a neutral layer to orchestrate and manage them all.

And in OpenRouter’s own announcement, the commitment that “routing decisions will remain driven by one thing: what’s best for you, the user,” alongside “if you build on OpenRouter today, nothing about your integration changes.”

We have no reason to doubt any of that today, and there is a real argument that Stripe is the least bad acquirer available, because Stripe does not train foundation models. If Google or AWS had bought this, the neutrality question would have answered itself immediately.

But the honest framing for a business making a five-year decision is this. You are being told that a company whose core business is taking a percentage of transactions now owns the layer that decides which transactions happen. The commitment is credible and the incentive structure changed anyway. Both are true. Plan for the version where the promise holds, and keep the ability to leave.

The other option had a worse year

The alternative to a hosted gateway is running your own. In practice that means LiteLLM, the MIT-licensed open-source proxy that speaks the OpenAI API format and fronts everything else. It is genuinely good software, it is free, and it keeps your prompts on infrastructure you control. That last point is the entire reason clinics, law firms and anyone with a data residency requirement chooses it, and we have recommended exactly that reasoning in our own writing on when local deployment is the right answer.

Here is its 2026, pulled from CISA’s KEV feed (catalog version 2026.09.04, 1,695 entries, 211 added this year) and cross-referenced against PyPI upload timestamps for the versions that fixed each one.

CVE	What it is	CVSS	Fixed in	Fix published to PyPI	Added to KEV	Fix available before KEV
CVE-2026-42208	Pre-authentication SQL injection. The Bearer token is concatenated into a query against the key table with no parameter binding.	9.8	1.83.7	April 13, 2026	May 8, 2026	25 days
CVE-2026-42271	Command injection via MCP test endpoints that accept a full server config, including the command to run, with no admin gate.	8.8 alone, 10.0 chained	1.83.7	April 13, 2026	June 8, 2026	56 days
CVE-2026-59822	MCP Streamable HTTP auth bypass. A fabricated Bearer token triggers an OAuth2 fallback that substitutes an empty auth object instead of rejecting.	8.8	1.84.0	May 14, 2026	September 2, 2026	111 days

Read the last column again, because it is the whole argument.

In all three cases the fix already existed. Not “a fix was being worked on,” not “a workaround was available.” The patched version was sitting on PyPI, downloadable, for 25 days, 56 days and 111 days respectively before CISA confirmed that attackers were exploiting the unpatched one in the wild. Sysdig documented targeted exploitation of the SQL injection within 36 hours of public disclosure. Nobody was waiting on the maintainers. They were waiting on operators.

For scale on how far behind that leaves people: LiteLLM’s current release is 1.100.0, published September 6. A deployment still vulnerable to CVE-2026-59822 is on something older than 1.84.0, which shipped in mid-May. That is sixteen minor versions of drift on a service that holds every model API key the business owns.

And the second one, CVE-2026-42271, is the reason this class of thing is worse than it looks in isolation. On its own it needs a valid proxy key. Chained with CVE-2026-48710, a Host header validation flaw in Starlette, the Python framework LiteLLM is built on, Horizon3.ai demonstrated that the authentication requirement disappears entirely and the combined chain rates CVSS 10.0 for unauthenticated remote code execution. Starlette went into KEV the same day as the September LiteLLM entry. We wrote about that batch, and about the broader pattern of exposed AI tooling, in our piece on AI tools in the KEV catalog. The short version is that your inventory needs to list what your tools are built on, not just what they are.

The March incident nobody outside security noticed

There is one more thing on the self-hosted side of the ledger, and it is not a vulnerability at all.

On March 24, 2026, at 10:39 UTC, two malicious LiteLLM releases were published to PyPI: 1.82.7 and 1.82.8. They were up for roughly forty minutes before PyPI quarantined them. PyPI’s guidance is to treat any installation performed through 16:00 UTC that day as potentially compromised, because of mirrors and caches.

Version 1.82.8 shipped a file called litellm_init.pth, which Python executes automatically on interpreter start. It harvested environment variables, specifically including OPENAI_API_KEY and ANTHROPIC_API_KEY, plus cloud keys, SSH keys, Kubernetes tokens and database passwords, encrypted them, and sent them to an attacker-controlled domain.

The route in was not LiteLLM. Attackers compromised Trivy’s GitHub repository on March 19 as part of the broader TeamPCP campaign, harvested credentials from there, and used them to push packages directly to PyPI. This is the same shape of attack we described in your website has hundreds of authors you have never met, just on the Python side of the fence.

CloudSEK recovered a dataset of roughly 434,000 captured files, mapping to more than 2,500 organisations including NVIDIA, Cisco, Deloitte, Volkswagen, FedEx, Siemens and X Corp. To CloudSEK’s credit, they said plainly that this is “not a victim count,” it is a count of files the attackers collected. We are repeating that caveat because most coverage did not, and because a headline number that means something other than what it appears to mean is exactly the sort of thing that ends up in a board deck.

The point for this article is narrower. A self-hosted gateway does not remove your dependence on other people’s trustworthiness. It relocates it, from a vendor’s uptime and integrity to a package registry’s, and it hands you the job of noticing.

How exposed is any of this, really

Censys published early findings from its 2026 State of the Internet work on July 23. Across 43 tracked AI and LLM tools, it found more than 294,000 distinct public IP addresses exposing at least one, up from roughly 183,000 in October 2025. That is over 60 percent growth in nine months.

Within that, LiteLLM exposure grew 97 percent over the observation window. Langflow, the other repeat offender in this category, grew 169 percent while accumulating 18 CVEs between 2024 and 2026.

Nobody sets out to put an AI gateway on the public internet. It happens because the thing was stood up on a cloud VM for a proof of concept in week one, the proof of concept worked, it quietly became production, and the security group was never tightened because nothing ever broke. We have described that failure mode before and it remains, by a distance, the most common one we find.

So should you run a gateway at all

Here is the part most vendor comparisons will not tell you.

Most small businesses should not. If you are calling one provider, spending under a few hundred dollars a month, and running one or two AI features, a gateway adds a dependency, a failure mode and a place for your prompts to sit, in exchange for benefits you are not yet large enough to collect. Point your code at Anthropic or OpenAI, put the key in a secret manager rather than a .env file that your web server might happily serve to anyone who asks (see what happened to hundreds of Stripe merchants last month), and get on with the actual work.

You have crossed the line into needing one when at least two of these are true:

1. A model provider outage would visibly break something a customer touches.
2. You are spending enough per month that a 30 to 50 percent cost saving from routing cheap work to cheap models is real money to you.
3. More than one team or product is calling models and you cannot currently answer “who spent what.”
4. You have a concrete reason to expect to switch primary models within a year.
5. You have a data residency or confidentiality obligation that dictates where inference traffic may go.

If it is only number five, you are looking at self-hosting. If number five is not on your list at all, you almost certainly want a hosted one.

The arithmetic, with real numbers

Every major gateway has abandoned per-token markup. The differences are in how they charge instead.

OpenRouter passes provider pricing through unchanged. From its own FAQ: “We pass through the pricing of the underlying providers; there is no markup on inference pricing (however we do charge a fee when purchasing credits).” That credit fee is 5.5 percent with a $0.80 minimum on card purchases, 5 percent on crypto.

The $0.80 floor matters more than the percentage at small scale. A $10 top-up costs $10.80, an effective 8 percent. A $500 top-up costs $527.50, the stated 5.5. If you use credits, buy in larger increments and stop topping up in tens.

But the more useful number is the one almost nobody quotes. Bring your own key is free up to $25,000 per month. OpenRouter’s FAQ describes a plan-dependent free allowance “measured by list-price inference cost, not request count,” with pay-as-you-go including $25,000 per month at no BYOK fee and Enterprise including $200,000, and a 5 percent fee above the allowance.

Work that through for a real small business. If you are spending $2,000 a month on models:

• Buying credits: about $110 a month in fees, roughly $1,320 a year.
• Bringing your own provider keys: $0 in gateway fees, because $2,000 is a long way under $25,000.

The trade is that BYOK requires an account and a payment method with each provider you use, and you lose the single-invoice convenience. For a business already holding an Anthropic and an OpenAI account, that convenience is worth considerably less than $1,320 a year. We would take the BYOK path every time at this scale, and we would revisit it only at the point where the allowance is actually in sight.

For completeness on the alternatives, and noting that this comparison is published by a competitor and should be read as such, Vercel’s own gateway roundup puts Vercel AI Gateway at zero markup including on BYOK for paid plans, Portkey at $49 a month for its production tier with a free open-source edition, Cloudflare AI Gateway’s core features as free on every plan, and LiteLLM as free software with self-hosting operations realistically costing several hundred to a couple of thousand dollars a month once you count the machine, the database and somebody’s time.

That last figure is the one people forget, and it is the same mistake we walked through in detail in the real total cost of running your own LLM. Free software on a server you own is not free. At $2,000 a month of model spend, a self-hosted gateway can plausibly cost more to operate than a hosted one costs in fees, before you price the patching discipline the table above demands.

Do this, in order

1. Find out whether you already have one. Ask whoever built your AI features one question: does our code call the model provider directly, or does it call something in the middle? If it is the middle, ask what and where. In our experience this is a surprisingly common source of “oh, right, that thing.”

2. If you self-host LiteLLM, check the version tonight. pip show litellm or the image tag in your compose file. Anything below 1.84.0 is vulnerable to a CVE that CISA confirmed was under active exploitation on September 2 with a federal remediation deadline of September 16. Current is 1.100.0.

3. Check the March supply chain window while you are there. If you installed or rebuilt on March 24, 2026, or pinned 1.82.7 or 1.82.8 at any point, treat every credential that process could read as burned and rotate it. CloudSEK published a searchable exposure dataset if you want to check by domain.

4. Confirm it is not reachable from the internet. Whatever port your gateway answers on, check it from outside your network, not from a machine inside it. Two failure modes account for nearly all of this: a cloud security group that allows 0.0.0.0/0, and a reverse proxy that forwards a path nobody remembers configuring.

5. Rotate the provider keys the gateway holds, and scope them. This is the component that, by design, holds every model key you own. Provider keys should be per-application and spend-capped, not one master key shared by everything.

6. If you use a hosted gateway, switch to bring-your-own-key. Under $25,000 a month of list-price usage it is free on OpenRouter, and it has a second benefit nobody advertises: your relationship with the model provider survives your relationship with the gateway. If the routing layer changes hands, changes terms, or has a bad week, your keys still work and your fallback is a config change rather than a procurement cycle.

7. Check the logging setting. OpenRouter’s default is no prompt or completion logging: “We do zero logging of your prompts/completions, even if an error occurs, unless you opt-in.” There is an opt-in that trades logging for a 1 percent usage discount. Somebody on your team may have taken it. If you handle client data, go and look rather than assume.

8. Write down what leaving costs. Not as a plan to leave. As a number. If your gateway vendor doubled its fee or changed its data terms next quarter, how many days of work is the migration? If the answer is more than a week, the neutrality you thought you were buying is not something you actually hold.

What we would tell a client this week

Nothing here is a reason to panic, and nothing here is a reason to rip anything out.

The Stripe acquisition is, on balance, more reassuring than the alternatives were. A payments company that does not train models is a better owner for a neutral router than any of the labs would have been, the commitments made in public are specific enough to be embarrassing to break, and the deal has not even closed yet. If you are on OpenRouter today, the correct action this week is to move to BYOK if you have not, and to write down the migration cost. That is it.

The self-hosted side needs more attention than it is getting. Three KEV entries in four months is not bad luck, and the pattern in that table is not a maintainer problem, it is an operations problem. LiteLLM is fine software that shipped its fixes promptly and got let down by the fact that nobody upgrades plumbing. If you run it, it belongs on the same patch cadence as anything else facing a network, which is the discipline CISA’s own risk-based triage is built around. If you cannot commit to that cadence, you are not actually choosing self-hosting for control. You are choosing it for the invoice, and the invoice is not where this gets expensive.

And the broadest point, which is the one worth keeping after the news cycle moves on: this year the AI gateway stopped being an implementation detail and became a vendor decision, a security boundary and a piece of leverage all at once. Nine figures of acquisition price and three exploited vulnerabilities are the market telling you the same thing from two directions. If nobody at your company can say which of those two paths you are on, that is the finding, and it is worth twenty minutes today.

If you would like us to look at what sits between your application and your model providers, what it holds, and whether it is reachable from outside, send us a note. It is a short review and we will tell you if the answer is “you do not need one of these.”

Sources

• Stripe agrees to acquire OpenRouter to help businesses optimize token routing and usage, Stripe Newsroom, August 19, 2026, retrieved and read in full September 8, 2026, for the “agreed to acquire” wording, the 400+ models and 80+ providers figures, the Patrick Collison and Alex Atallah quotes, the reference to Token Billing, and the absence of any token volume figure or disclosed terms
• OpenRouter is Joining Stripe, OpenRouter Blog, August 19, 2026, retrieved September 8, 2026, for the neutrality commitment, the “nothing about your integration changes” statement, and the customary closing conditions and “coming weeks” timeline
• Stripe will reportedly acquire AI gateway startup OpenRouter for $7B+ and Stripe didn’t really buy OpenRouter because of the ‘singularity’, TechCrunch, August 16 and 19, 2026, retrieved September 8, 2026, for the $7.5 billion figure, the $1.5 billion founder allocation and the Bloomberg attribution
• Stripe, OpenRouter finally strike a deal, Payments Dive, August 2026, retrieved September 8, 2026, for the New York Times price attribution and the widely repeated 10 trillion tokens per day and 10 million developer figures
• OpenRouter more than doubles valuation to $1.3B in a year, TechCrunch, May 26, 2026, retrieved September 8, 2026, for the $113 million Series B, the $1.3 billion post-money valuation, the CapitalG lead, the prior $547 million valuation, the 8 million users, the 100 trillion tokens per month figure and the fivefold growth over six months
• Stripe to Acquire OpenRouter: Why Everyone Is Obsessed With Model Routing, Menlo Ventures, August 19, 2026, retrieved September 8, 2026, for the 4.5 quadrillion annual token run rate, the eleven-week doubling, the 500 models and 10 million users claims and the argument about the routing dataset. Menlo is an investor in OpenRouter
• Stripe will reportedly acquire OpenRouter for $7B+, Hacker News thread, August 2026, retrieved September 8, 2026, for the market cap comparison quote
• Known Exploited Vulnerabilities Catalog JSON feed, CISA, catalog version 2026.09.04, downloaded and counted directly September 8, 2026, for the three BerriAI LiteLLM entries and their dates added and due dates, the Kludex Starlette entry, the 1,695 total entries and the 211 entries added in 2026
• litellm release history, PyPI JSON API, queried September 8, 2026, for the upload timestamps of 1.83.6 (April 13), 1.83.7 (April 13), 1.84.0 (May 14) and the current 1.100.0 (September 6). Several secondary sources date the 1.83.7 release to May 8, 2026, which is the date CISA added CVE-2026-42208 to KEV, not the date the fix shipped
• CVE-2026-42208: Targeted SQL injection against LiteLLM’s authentication path discovered 36 hours following vulnerability disclosure, Sysdig, 2026, retrieved September 8, 2026, for the exploitation timeline and the unbound Bearer token concatenation
• CVE-2026-42271 chained with CVE-2026-48710, Horizon3.ai, 2026, retrieved September 8, 2026, for the MCP test endpoint subprocess flaw, the affected range of 1.74.2 to 1.83.6, the PROXY_ADMIN fix and the CVSS 10.0 unauthenticated chain
• CVE-2026-59822: LiteLLM MCP Authentication Bypass via OAuth2 Passthrough Fallback, GitLab Advisory Database, retrieved September 8, 2026, for the fallback behaviour and the 1.84.0 fix
• CISA Adds Seven Exploited Flaws as Attackers Deploy Reverse Shells and Crypto Miners, The Hacker News, September 3, 2026, retrieved September 8, 2026, for the September 2 KEV batch, the CVSS scores and the observed attack activity
• Malicious LiteLLM Releases Tied to Trivy Hack May Have Exposed 2,100+ Organizations, The Hacker News, August 12, 2026, retrieved September 8, 2026, for the March 24 timeline, the 10:39 UTC publication and 40 minute window, the 16:00 UTC guidance, versions 1.82.7 and 1.82.8, the litellm_init.pth mechanism, the exfiltration domain, the Trivy compromise on March 19, and CloudSEK’s 434,000 files, 2,500 organisations and explicit “not a victim count” caveat
• Censys Finds AI/LLM Tool Exposures Up More Than 60%, eSecurity Planet, reporting Censys findings published July 23, 2026, retrieved September 8, 2026, for the 294,000 exposed IP addresses across 43 tools, the 183,000 October 2025 baseline, the 97 percent LiteLLM growth and the 169 percent Langflow growth
• OpenRouter FAQ, retrieved September 8, 2026, for the no-markup statement quoted verbatim, the 5.5 percent credit fee with $0.80 minimum, the 5 percent crypto fee, the BYOK allowance described as measured by list-price inference cost with $25,000 per month on pay-as-you-go and $200,000 on Enterprise, the 5 percent fee above the allowance, the zero-logging default and the 1 percent opt-in discount
• 7 Best AI Gateways in 2026, Compared, Vercel, retrieved September 8, 2026, for the comparative pricing of Vercel AI Gateway, Portkey, Cloudflare AI Gateway and self-hosted LiteLLM. This page is published by one of the vendors it compares