AI Provider Keys

AI provider keys are the secret credentials that let software, employees, or automated tools call a commercial AI service such as OpenAI, Anthropic, or Google, and they are billed to the organization that holds them. Because a leaked key can be used to run up large charges, expose data sent to the model, or act under the company's account, these secrets are a frequent target for theft through code repositories, shared documents, and compromised developer tools. For governance teams, the key questions are who issues these keys, where they are stored, how often they are rotated, and whether usage can be traced back to a specific person or system.

1 item

Corporate PolicyGlobal2026-10-22

LiteLLM Compromise Drained AI Provider Keys and Cloud Secrets From Proxy Installs

A malicious version of LiteLLM (1.107.0) was published to PyPI on October 21, 2026. LiteLLM routes traffic between enterprise applications and AI providers. The tampered release silently collected and sent AI provider credentials, cloud access keys, SSH keys, pipeline secrets, and browser passwords to an attacker-controlled server. All seven platform variants of the package were affected.

supply chain attack LiteLLM credential theft AI tooling security LLM infrastructure PyPI AI provider keys