Unrevoked Key Let Attackers Poison Popular AI Tool LiteLLM

LiteLLM, an open-source tool widely used by AI developers, has explained how attackers hijacked its software supply chain. In a root-cause analysis, the project said it mistakenly exposed a configuration file in May containing the master key to an internal tool used to run AI agents. The company spotted and removed the file, but did not revoke the key. Earlier this month, an unidentified attacker used it to reach LiteLLM's tooling and obtain an access token controlling all of its GitHub repositories.

The attacker then used that access to distribute a version of the tool containing credential-harvesting malware. Wiz reported the package was downloaded about 49,000 times during the roughly two hours it was on the Python Package Index (PyPI). Within about four and a half hours of upload, the attacker was testing stolen AWS credentials to see which AI models the accounts could reach. Wiz said this matches "LLMjacking", where criminals run AI services on stolen cloud accounts and leave victims with the bill. No affected organisation has publicly confirmed a breach. Microsoft said the malware was built to run whenever Python started on an infected machine, even if LiteLLM was not being used.

LiteLLM advised that anyone who installed the compromised version (1.107.0) on an internet-connected computer should assume their credentials were stolen. They should change every password and access key that the machine could reach. LiteLLM said it is also revoking tokens across its internal systems and vendor platforms.