LiteLLM says hackers took the keys they needed from its own logs. They used them to publish a poisoned version of its software on Wednesday. The open-source AI gateway explained it in an incident report. Its chief executive, chief technology officer and director of security signed it.
Its engineers found that Anthropic’s coding agent, Claude Code, sometimes puts a user’s GitHub command-line login token into a response. If something logs those responses, the tokens may end up in LiteLLM’s logs, the company said.
“We believe the attacker gained access to this deployment, obtained the GitHub CLI OAuth tokens from its logs, and subsequently used those credentials to compromise our release workflow,” LiteLLM wrote.
The deployment was LiteLLM’s own internal one, open to the public internet. It held an “unexpected, innocuously named user account”, the company said. LiteLLM has not confirmed how the attacker got in, but suspects a recently patched vulnerability.
Three stolen tokens
LiteLLM lets developers reach many AI models through one API. The poisoned version, 1.107.0, sat on PyPI from 11:39 to 13:23 UTC on 21 October. PyPI is the main Python package index. Its Docker images were live from 11:46 to 14:20 UTC. LiteLLM said its official 1.107.0 source tag on GitHub does not contain the malicious files.
Researchers at Upwind first reported the poisoned release on GitHub. LiteLLM said on X that it learned of it at 6:32am Pacific time. That was almost two hours after the release went out.
The attacker held three developers’ GitHub credentials. On Monday, LiteLLM had widened release rights so two engineers could ship daily fixes for customers. The attacker used a token from one of its two GitHub organisation owners to switch off branch protection. A second developer’s credential approved the production release, which was built from a lookalike repository, Berri-AI/litellm. A third deleted the workflow records.
Stolen keys put to use
The package carried a credential stealer and a backdoor, according to the security firm Wiz. Both were set to run when Python starts. The stealer took browser passwords and cookies, cloud keys, SSH keys and API keys for AI services. It also pulled the AI provider keys stored in a LiteLLM proxy’s database.
The backdoor works only on Linux and macOS. Every hour, it checked a GitHub repository for a server to fetch more code from. That repository never held more than test values, and GitHub took it down, Wiz said. It added that the malware showed strong signs of being written with AI help.
Wiz cited data from ClickPy showing about 49,000 downloads of the poisoned version. About four and a half hours after the theft, Wiz saw the attacker test stolen Amazon Web Services credentials. They came from build servers and Kubernetes nodes. The checks included listing models on Amazon Bedrock. Wiz said this was consistent with LLMjacking, the use of stolen cloud access to run AI models.
“The dual-technique approach, using both .pth files and sitecustomize.py simultaneously, appears to be the first documented case in the wild,” Wiz researchers Benjamin Read and Rami McCarthy wrote.
The attack landed on the same day as two critical PHP flaws.
A second attack this year
It is LiteLLM’s second compromise in 2026. In March, two poisoned versions sat on PyPI for about 40 minutes. LiteLLM traced that attack to Trivy, a security scanner in its build pipeline. Hackers also used Trivy to breach the European Commission. Mercor, an AI data firm, was hit too, and Meta froze AI data work with the company.
Socket, a supply-chain security firm, told The Hacker News it had found no evidence linking the two attacks. It said the encryption keys, the way data was sent out and the backdoor all differ.
“That doesn’t rule out the same operator using different tooling, but we don’t have evidence to support that attribution,” Socket said.
LiteLLM told users to pin version 1.106.2 or another release published before the attack, delete the three malicious files and rotate every secret the affected machines could reach. It said enterprise customers who pull from its private registry had no exposure.