The open-source ecosystem, a cornerstone of modern AI development, was rocked this week as LiteLLM—a critical gateway service that allows developers to interact with multiple AI models through a unified API—disclosed a sophisticated supply chain attack. The incident resulted in the distribution of poisoned software packages via PyPI and Docker, exposing thousands of developers to credential theft, backdoors, and potential "LLMjacking."
In a detailed incident report signed by its executive leadership, including its CEO, CTO, and Director of Security, LiteLLM confirmed that the breach was facilitated by stolen GitHub credentials. In a bizarre twist of digital irony, the keys were harvested from the company’s own internal logs, which had been contaminated by a security oversight involving an AI coding assistant.
The Genesis of the Breach: An AI-Powered Leak
The root cause of the incident highlights the emerging risks associated with the integration of AI coding agents into developer workflows. LiteLLM engineers discovered that Anthropic’s "Claude Code"—an AI-powered command-line interface designed to assist with programming tasks—had been inadvertently exfiltrating sensitive data.
According to the company, the coding agent would occasionally include a user’s GitHub CLI OAuth token within its conversational responses. Because LiteLLM’s internal deployment was configured to log these interactions, those high-privilege tokens were stored in plain text within the company’s logs.
"We believe the attacker gained access to this deployment, obtained the GitHub CLI OAuth tokens from its logs, and subsequently used those credentials to compromise our release workflow," the company stated. The internal deployment in question was exposed to the public internet and contained an "unexpected, innocuously named user account." While LiteLLM has not yet finalized its investigation into how the initial access was gained, the company suspects that a recently patched vulnerability in their infrastructure provided the entry point.
Chronology of the Compromise (October 21, 2026)
The attack was a model of precision and speed, unfolding over several hours on October 21.
- 11:39 UTC: The poisoned version of LiteLLM, labeled 1.107.0, is uploaded to PyPI, the primary repository for Python packages.
- 11:46 UTC: Malicious Docker images are pushed, making the compromised environment available to containerized deployments.
- 13:23 UTC: The malicious package remains live on PyPI for nearly two hours before being addressed.
- 14:20 UTC: The malicious Docker images are finally taken offline.
- 18:32 UTC (06:32 Pacific Time): LiteLLM officially acknowledges the breach, nearly two hours after the poisoned code had already begun circulating.
The attackers leveraged three distinct stolen developer credentials to bypass security controls. Having recently expanded release permissions to facilitate daily customer fixes, LiteLLM’s environment became vulnerable to coordinated manipulation. One attacker used a stolen credential from a GitHub organization owner to disable branch protection, a critical security guardrail. A second compromised account was used to approve a production release built from a "lookalike" repository (Berri-AI/litellm), while a third account was utilized to wipe the audit trail by deleting workflow records.
Technical Analysis: The Wiz Findings
Security firm Wiz provided a chilling analysis of the malicious payload hidden within the 1.107.0 update. The package contained both a credential-stealing module and a persistent backdoor, both of which were designed to execute automatically upon the initialization of the Python environment.
The credential stealer was indiscriminate, designed to harvest browser cookies, saved passwords, SSH keys, cloud provider credentials, and—most crucially—the API keys for various AI services stored within the LiteLLM proxy database.
The backdoor, which functioned exclusively on Linux and macOS environments, performed hourly "check-ins" to an external GitHub repository to fetch additional instructions. While the repository only contained test values during the window of the attack, the capability for remote code execution (RCE) was absolute. Wiz researchers Benjamin Read and Rami McCarthy noted that the malware exhibited signs of being authored with the assistance of LLMs, and they highlighted a "dual-technique" approach—utilizing both .pth files and sitecustomize.py—which represents the first documented instance of this specific combination in the wild.
The Scope of Impact: LLMjacking and Beyond
The potential damage is significant. According to data from ClickPy, the poisoned version was downloaded approximately 49,000 times before it was identified.
Four and a half hours after the initial theft, researchers observed the attacker testing stolen Amazon Web Services (AWS) credentials. These credentials had been pulled from build servers and Kubernetes nodes. The attackers engaged in what is known as "LLMjacking"—the unauthorized use of hijacked cloud infrastructure to run high-cost, high-volume AI models, essentially turning the victim’s compute budget against them. By listing models on Amazon Bedrock, the attackers were mapping out the extent of the cloud resources available to them for future exploitation.
Official Response and Mitigation
LiteLLM has issued a stern directive to its user base:
- Pin Versions: Users must immediately revert to version 1.106.2 or any earlier release published before October 21.
- Cleanup: Affected systems must have the three specific malicious files identified in the report deleted.
- Secret Rotation: Because the malware actively scraped environment variables and API keys, LiteLLM insists that all secrets reachable by the affected machines—including database passwords, cloud tokens, and AI service keys—must be considered compromised and rotated immediately.
The company clarified that enterprise customers utilizing its private registry were not exposed, as the poisoned release was only pushed to the public PyPI and Docker channels.
Implications: A Recurring Nightmare
This incident marks the second time this year that LiteLLM has faced a supply chain compromise. In March 2026, the company fell victim to an attack involving the security scanner "Trivy," which was used to inject malicious code into their build pipeline. That previous incident was part of a wider campaign that impacted the European Commission and AI data firm Mercor.
While industry experts, including the supply-chain security firm Socket, have stated there is no immediate evidence linking the March breach to this October incident, the implications for the AI industry are stark. The differences in encryption keys, data exfiltration methods, and backdoor architecture suggest that either a different threat actor is at work, or the same operator is iterating on their tooling.
"That doesn’t rule out the same operator using different tooling, but we don’t have evidence to support that attribution," Socket noted in a statement.
Conclusion: The Vulnerability of Trust
The LiteLLM breach serves as a watershed moment for the AI software supply chain. It underscores the fragility of automated developer tools and the dangers of "shadow" internal deployments that lack the rigorous security oversight of production environments. As developers increasingly rely on AI-assisted coding tools, the need for sandboxing these agents becomes paramount.
If a simple coding assistant can accidentally dump high-privilege credentials into a log file that is then indexed and exploited by malicious actors, the entire foundation of open-source security must be re-evaluated. For now, the developer community is left to clean up the mess, rotate thousands of compromised secrets, and reckon with the reality that the tools used to build the future of AI can, if left unchecked, become the primary vectors for its subversion.
