Popular AI tool LiteLLM says unrevoked key allowed hackers to target users

LiteLLM, an open-source tool widely used by artificial intelligence developers, said Friday that a key accidentally exposed in May was behind a supply-chain attack that is believed to have hit tens of thousands of users last week.

In a root-cause analysis published Friday, the project traced the attack to the company's own mistaken exposure months before of a configuration file containing the master key to an internal tool used by LiteLLM to run AI agents.

Although the company spotted the publication at the time and removed the file, it failed to revoke the exposed key. Earlier this month, an unidentified attacker used the key to access LiteLLM’s tooling and grab an access token giving them control over all of LiteLLM’s repositories on GitHub.

According to the initial incident report, the attacker then exploited "multiple independent security controls” last week to distribute a version of the tool containing credential-harvesting malware to the software’s users.

Google-owned cloud security company Wiz said the compromised package was downloaded about 49,000 times and that the cloud credentials stolen from LiteLLM users were being tested within hours.

The malicious package remained on the Python Package Index (PyPI) for about two hours. Within about four and a half hours of it being initially uploaded, the attacker was trying out stolen login credentials for Amazon’s AWS cloud service to see which of Amazon’s AI models the accounts could access.

Wiz said this matched a pattern known as “LLMjacking,” in which criminals use stolen cloud accounts to run AI services and leave the victims with the bill. No affected organization has publicly confirmed a breach linked to the release.

According to Microsoft, the malware was designed to run whenever the Python programming language started up on an infected machine, even if the program that was being run never used LiteLLM itself.

LiteLLM warned that anyone who installed the compromised version (1.107.0) on an internet-connected computer should assume their credentials were stolen. Those entities were advised to change every password and access key that the affected computer could reach.

LiteLLM said it too was revoking tokens across its internal systems and vendor platforms.

The incident is the second supply chain compromise of LiteLLM this year. In March, attackers published malicious versions to PyPI in a campaign later linked to the TeamPCP hacking group. Australian police have since charged two men alleged to be TeamPCP members.