One Unrevoked Key Let an Attacker Slip a Malicious LiteLLM Package Into the Release Pipeline

LiteLLM, the maker of a popular open source gateway for large language models, has disclosed how an attacker pushed a malicious version of its Python package. On May 27, 2026, a configuration file committed to a public GitHub repository accidentally contained the master key for a deployment of its Agent Platform, a tool used to orchestrate agents. The team spotted the mistake, overwrote the commit and flagged the exposed keys for revocation. However, the master key was never revoked.

LiteLLM says an unknown attacker used that key on October 10, 2026 to access the Agent Platform. They extracted a GitHub CLI OAuth token that let self-hosted cloud agents file pull requests. The token was not scoped down and was tied to the GitHub organization owner's account, giving the attacker owner-level access to every repository in the organization, plus the ability to steal more credentials.

Normally, a release must be started by an authorized engineer and approved by a special account locked to a physical device in the office. That rule had been relaxed earlier in the week to allow more frequent releases, so any two engineers could trigger and approve one. The attacker used stolen tokens to do both, after repointing the deployer to their own malicious repository. LiteLLM notes the attacker could have loosened the controls further, and suspects they held back to avoid detection.