The poisoned release of LiteLLM, a widely used open-source gateway that connects applications to many AI model providers, began with a master key the project accidentally published in May and never revoked, according to a root-cause analysis LiteLLM released Friday and reported by The Record Monday. The chain that followed, from one forgotten secret to an all-powerful bot token to a weakened release approval, maps onto controls that any company shipping software or running AI agents can check in its own shop.
The Primary Wire reported the attack Oct. 21, citing The Register. At that point LiteLLM suspected the attacker had entered through a recently patched flaw in an internet-exposed internal system. The new analysis replaces that account: LiteLLM calls it "the canonical source of truth" and says earlier status updates contained assumptions that proved inaccurate or incomplete.
What Happened
According to LiteLLM's analysis of the attack chain, on May 27 a configuration file containing the master key for the LiteLLM Agent Platform, an internal tool in early testing that runs AI agents, was committed to a public LiteLLM repository. The commit was overwritten, but the key itself was never revoked.
That platform operated with a GitHub command-line token belonging to an owner of the project's GitHub organization. The token was not tied to a dedicated service account and was not limited in scope. On Oct. 10 the attacker used the master key to query the platform's programming interface, which returned the owner's token, granting control over every repository.
The same evening, the attacker ran automated build jobs on throwaway branches that sent stored secrets to an outside web address, collecting the GitHub tokens of two more maintainers, then deleted the job records. A second round on Oct. 12 took secrets from private repositories.
On Oct. 21 the owner's token overrode branch protection, the setting meant to block unreviewed changes, and the release was pointed at a lookalike repository, Berri-AI/litellm. Normally a release needed approval from a special account locked to a physical device in LiteLLM's office. That rule had been relaxed earlier that week so any two engineers could trigger and approve a release. The attacker used one stolen token to start the release and another maintainer's to approve it.
Seven malicious version 1.107.0 packages reached PyPI, the main public registry for Python software, and container images went to Docker Hub and GitHub's container registry. A third token deleted the run records, and the owner's token force-pushed the main code branch back to its prior state. The company said the artifacts were live for about two hours. GitHub's audit log recorded each override; LiteLLM believes the attacker spread actions across separate tokens to bury them in noisy logs.
Why It Matters
Scale is becoming clearer. Wiz, a Google-owned cloud security firm, counted about 49,000 downloads of the compromised package, The Record reported. Downloads are not the same as infected machines, and no affected organization has publicly confirmed a breach tied to the release. Microsoft found the malware ran whenever Python started on an infected machine, even if LiteLLM was never used, according to The Record.
The Record also reported that within about four and a half hours of the upload, the attacker was testing stolen Amazon Web Services credentials to see which Amazon AI models they could reach. Wiz said that matched "LLMjacking," in which criminals run AI services on stolen cloud accounts and leave victims with the bill.
For boards and engineering leaders, the failures are ordinary ones: a leaked secret removed from view but not rotated, an automation tool holding a top-level human account's token, and a release safeguard loosened for speed. Each appears in LiteLLM's own account, and each can be audited elsewhere. LiteLLM says anyone who installed 1.107.0 on an internet-connected computer should assume their credentials were stolen and change every password and key that machine could reach.
What to Watch
LiteLLM is revoking every token tied to its internal systems and vendor platforms and assumes all credentials were taken. It said it would explain what it is changing next week. LiteLLM does not attribute the attack; a March compromise of the project was later linked to a group called TeamPCP, The Record reported. Watch for organizations disclosing cloud or AI-account abuse traced to the stolen credentials.
