LiteLLM Supply Chain Attack Stole AI and Cloud Credentials in 23M-Download Library
What happened
Attackers compromised the release pipeline for LiteLLM. The library lets enterprises send requests to AI providers like OpenAI, Anthropic, and Google through a single interface. Attackers published a malicious version (1.107.0) through PyPI, the standard Python software repository, and through Docker, a common container platform. According to reporting by The Register, the malicious version harvested API keys for AI providers, cloud platform credentials, browser-stored passwords, and SSH keys. It also installed a remote access trojan, giving attackers ongoing control of infected machines with no visible sign to the user. LiteLLM receives approximately 23 million weekly downloads, meaning the compromised version had an unusually wide potential reach across enterprise AI deployments. Security researchers confirmed that version 1.106.2 was the last safe release. This incident follows a pattern of AI infrastructure dependencies becoming primary attack targets. Earlier examples include the OpenCode breach that exposed API keys for Anthropic, OpenAI, and Google and three coordinated attacks targeting AI keys, LLM APIs, and provider access controls.
Why it matters
- ·Organizations using LiteLLM face immediate credential-rotation obligations. Any AI provider API key, cloud access credential, or server login accessible from an affected environment must be treated as compromised and replaced, even without evidence of misuse.
- ·This incident exposes a structural gap in most AI governance programs. Software libraries that route traffic to AI providers sit inside the AI attack surface but are rarely included in AI system inventories, version-control policies, or supply chain risk assessments. This leaves procurement and compliance teams blind to a high-impact dependency.
- ·Regulators and examiners are already scrutinizing AI supply chain controls. An undetected malicious AI infrastructure package in a regulated industry could trigger breach-notification obligations, model risk management findings, or inquiries under the EU AI Act (Regulation (EU) 2024/1689), which requires demonstrable oversight of third-party components in high-risk AI systems.
Governance controls affected
What to do now
- ☐Check every environment where LiteLLM is installed and confirm whether version 1.107.0 was ever present; if it was, escalate immediately to your incident response team and begin credential rotation before investigating further.
- ☐Rotate all AI provider API keys (for OpenAI, Anthropic, Google, and any other provider routed through LiteLLM), cloud platform credentials, and SSH keys that were accessible from any affected machine, even if you see no sign of misuse.
- ☐Ask your engineering or DevOps team whether version pinning is enforced for LiteLLM and other AI infrastructure libraries, meaning whether your systems are locked to a specific approved version or can automatically pull the latest release from a public repository.
- ☐Add LiteLLM and similar AI integration libraries to your AI system inventory and supply chain risk assessment program, and assign a control owner responsible for monitoring these dependencies for security advisories.
- ☐Review vendor notification requirements in your AI provider contracts to determine whether a supply-chain compromise affecting keys used to access those providers triggers a disclosure obligation.
What to watch next
Security teams should monitor for indicators that stolen credentials have been used to exfiltrate data. Attackers often delay exploitation to avoid immediate detection, so monitoring should continue for weeks following the incident. Compliance teams should watch for regulatory guidance that explicitly includes AI integration libraries within software supply chain controls. Frameworks like the NIST AI Risk Management Framework (AI RMF 1.0) and Playbook and the EU AI Act (Regulation (EU) 2024/1689) continue to develop implementation guidance for third-party AI component governance. Enforcement signals in the Five Eyes Guidance on the Careful Adoption of Agentic AI Services suggest dependency-level controls will face formal examination in regulated industries within the next compliance cycle.
Stay ahead of stories like this
Get every Global AI governance development like this one, plus the rest of the week's developments. Every Thursday.
Recent issues
- Compromised AI infrastructure, expanding federal enforcement, and confirmed agent deception are converging to raise the baseline compliance burden across every enterprise AI program this week.22 Oct
- Regulators, litigants, and attackers are all moving faster than most organizations' AI governance frameworks, shifting leverage away from deployers and toward those who can prove control, accountability, and honest disclosure.21 Oct
Free every Thursday. Unsubscribe anytime.