When AIOps Become "AI Oops": Subverting LLM-driven IT Operations via Telemetry Manipulation

TL;DR

This paper reveals security vulnerabilities in LLM-driven AIOps by demonstrating how adversaries can manipulate telemetry data to mislead automated IT management systems, and proposes a defense mechanism to mitigate such attacks.

Contribution

It introduces AIOpsDoom, an automated attack method on AIOps systems via telemetry manipulation, and proposes AIOpsShield, a defense mechanism to secure telemetry data against such attacks.

Findings

AIOpsDoom effectively manipulates telemetry to mislead AIOps agents.

AIOpsShield reliably blocks telemetry-based attacks.

The study highlights security risks in AI-driven IT operations.

Abstract

AI for IT Operations (AIOps) is transforming how organizations manage complex software systems by automating anomaly detection, incident diagnosis, and remediation. Modern AIOps solutions increasingly rely on autonomous LLM-based agents to interpret telemetry data and take corrective actions with minimal human intervention, promising faster response times and operational cost savings. In this work, we perform the first security analysis of AIOps solutions, showing that, once again, AI-driven automation comes with a profound security cost. We demonstrate that adversaries can manipulate system telemetry to mislead AIOps agents into taking actions that compromise the integrity of the infrastructure they manage. We introduce techniques to reliably inject telemetry data using error-inducing requests that influence agent behavior through a form of adversarial reward-hacking; plausible but incorrect system error interpretations that steer the agent's decision-making. Our attack methodology, AIOpsDoom, is fully automated--combining reconnaissance, fuzzing, and LLM-driven adversarial input generation--and operates without any prior knowledge of the target system. To counter this threat, we propose AIOpsShield, a defense mechanism that sanitizes telemetry data by exploiting its structured nature and the minimal role of user-generated content. Our experiments show that AIOpsShield reliably blocks telemetry-based attacks without affecting normal agent performance. Ultimately, this work exposes AIOps as an emerging attack vector for system compromise and underscores the urgent need for security-aware AIOps design.