A 40-minute window. That's all it took.
On March 24, 2026, two poisoned versions of LiteLLM — the massively popular open-source AI gateway — sat on PyPI for less than an hour. In that tiny window, the malware silently swept through memory, harvested every secret it could find, and exfiltrated the loot to an attacker-controlled server. Months later, a 153GB archive containing the stolen data has surfaced, and the scale is staggering: AWS, Samsung, Cisco, NVIDIA, Salesforce, Siemens, Deloitte, FedEx, Volkswagen, Epic Games, and 2,480+ more organizations had their credentials exposed.
This is the largest AI infrastructure supply chain breach of 2026. And the credentials are still working.
What Is LiteLLM?
LiteLLM is an open-source Python library that acts as a unified gateway between applications and large language model providers. Instead of writing custom integrations for OpenAI, Anthropic, Google, and dozens of other providers, developers drop LiteLLM into their stack and get a single interface. It's installed thousands of times a day across CI/CD pipelines, development environments, and production systems.
That ubiquity is exactly what made it such a devastating attack vector.
How the Attack Happened
The LiteLLM compromise was part of a broader supply chain campaign orchestrated by TeamPCP — a loose but highly capable threat group largely composed of teenagers, according to security researchers. Google tracks them as UNC6780.
Their playbook was elegant in its simplicity:
-
Compromise the publishing token. Attackers obtained a PyPI publishing credential for LiteLLM, likely through the earlier Trivy supply chain breach (CVE-2026-33634), which gave them force-push access to multiple repositories.
-
Push poisoned packages. On March 24, versions 1.82.7 and 1.82.8 appeared on PyPI. They contained a file called
litellm_init.pth— a Python startup hook that executes automatically whenever the Python interpreter initializes, whether or not you explicitly import LiteLLM. -
Harvest everything. The malware swept live environment memory and configurations for SSH keys, AWS/GCP/Azure credentials, Kubernetes tokens, database passwords,
.envfiles, LLM API keys (includingOPENAI_API_KEYandANTHROPIC_API_KEY), and gateway configuration. -
Exfiltrate and vanish. Data was encrypted and sent to
models.litellm[.]cloud— an attacker-controlled domain unrelated to the legitimate project. PyPI quarantined the packages after roughly 40 minutes.
The .pth file trick is particularly nasty. Python processes these files at interpreter startup, meaning the malicious code ran in any Python process in the affected environment — not just LiteLLM sessions. A single compromised CI pipeline could leak every secret accessible to that runner.
The Blast Radius
CloudSEK and Hudson Rock independently obtained and analyzed a 153GB RAR archive containing 433,909 files. The analysis attributed 118,829 CI runner dumps to 2,488 affected corporate domains, impacting 434,000 CI/CD pipelines.
The high-confidence exposure list reads like a Fortune 500 roster:
- Tech: AWS, NVIDIA, Cisco, Samsung, Salesforce, ServiceNow, Zscaler, NGINX
- Enterprise: Siemens, S&P Global, Deloitte, Thomson Reuters, Munich Re
- Industrial: Airbus, John Deere, FedEx, Volkswagen, Deutsche Bahn
- Finance: London Stock Exchange Group, Krungthai Bank
- Media & Entertainment: Epic Games, X Corp, SiriusXM
- Telecom: Vodafone, BT Group, Orange
- Other: Philips, HP, Thales, Carl Zeiss, Regeneron, Kroger
Independent security researcher Kevin Beaumont confirmed the data is legitimate and tested credentials from the dump months after the attack. The result? Almost every one still worked. One of the biggest US tech companies had assured him they'd rotated all affected credentials. They hadn't.
Why This Matters for AI Infrastructure
This breach exposes a fundamental blind spot in how organizations adopt AI tooling:
AI gateways sit at the highest-privilege intersection in modern stacks. They touch data, identity, compute, and autonomous action simultaneously. They hold API keys for every model provider, connect to cloud infrastructure, and often run with broad IAM permissions. A single compromised gateway doesn't just leak one secret — it leaks all of them.
Open-source AI dependencies multiply attack surfaces. LiteLLM can be pulled in as a transitive dependency by agent frameworks, orchestration tools, or CI/CD scripts that never explicitly chose it. If anything on your host installed it, you're in scope — whether your team knows it or not.
The speed-to-production culture around AI outpaces security. As Beaumont put it: "It's a massive supply chain breach due to poor AI security — not because AI is the threat, but teens can run circles around orgs obsessed with rushing out AI and poor DevOps security."
The FBI Weighs In
In July 2026, the FBI issued advisory FLASH-20260702-01 warning that TeamPCP affiliates are likely to weaponize stolen credentials long after the initial compromise. The bureau urged organizations to rotate CI/CD secrets, publishing tokens, and all cloud credentials that were accessible during the exposure window.
The advisory specifically called out the shift from long-lived tokens to temporary credentials — a move that would have dramatically limited the blast radius of this breach.
What You Should Do Now
If your organization uses LiteLLM — or any AI infrastructure that depends on it — here's the playbook:
-
Check for compromised versions. Search your environment for LiteLLM versions 1.82.7 and 1.82.8. Any install on March 24, 2026 (up to 16:00 UTC) should be treated as compromised.
-
Rotate aggressively. Don't just rotate the LiteLLM or model-provider key. Assume any secret accessible to the affected process is compromised: AWS/GCP/Azure IAM keys, Kubernetes service account tokens, GitLab/GitHub PATs, database passwords, SSH keys.
-
Audit for persistence. Check for unexpected cron jobs, systemd services, reverse SSH connections, or unauthorized push events in your repositories.
-
Implement network egress filtering. Restrict outbound traffic from CI/CD runners to prevent data exfiltration even if a package is compromised.
-
Move to short-lived tokens. Replace long-lived API keys and publishing tokens with temporary credentials (OIDC-based federation, short-lived PATs, ephemeral runners).
-
Pin your dependencies. Use lockfiles and verify package integrity hashes. Don't let unpinned transitive dependencies pull in poisoned packages.
Key Takeaways
- 40 minutes of exposure in March led to credentials from 2,500+ organizations being leaked in a 153GB archive
- The malware used a
.pthstartup hook — it ran whenever Python initialized, even without importing LiteLLM - 434,000 CI/CD pipelines had their credentials harvested; many remain valid months later
- The attackers (TeamPCP / UNC6780) gained publishing access through an incomplete credential rotation in the related Trivy breach
- AI infrastructure sits at the intersection of data, identity, and compute — making it the highest-value target in modern supply chains
- The FBI warns that stolen credentials will continue to be weaponized; organizations must rotate and move to short-lived tokens immediately
The LiteLLM breach isn't just a story about one compromised package. It's a preview of how supply chain attacks will evolve as AI tooling becomes the connective tissue of enterprise software. The question isn't whether your organization will face something like this — it's whether you'll catch it in 40 minutes, or discover it months later in a public archive.