Tech Analysis

LiteLLM Was Compromised Twice. What an AI Gateway Holds

October 2026. This is a developing story, and details may change.

The short version

On 21 October 2026, version 1.107.0 of LiteLLM, a very widely used Python package that routes requests to AI providers, was published to PyPI with a credential stealer and a remote-code backdoor inside it. Security firms including StepSecurity, SafeDep, Socket and JFrog reported it within hours, and the release was pulled from PyPI the same day. It is the second serious compromise of the project this year. This piece covers what is known so far, why a tool like this is such an attractive target, and the habits that limit the damage when a dependency goes bad.

What happened

The release. Reports put the upload to PyPI at around 11:39 UTC on 21 October, with the release removed by about 13:23 UTC. All seven PyPI wheels carried the malicious payload, and so did the official Docker images, including tags such as latest while they pointed at the bad release.
What was clean. The source tarball had no payload, though its build configuration was tampered with, and the corresponding Git tag was clean. Researchers list 1.106.2 and earlier, plus the 1.107.0 release candidates, as clean.
How it ran. A small path file, cook.pth, made Python load the malicious code every time the interpreter started, even in programs that never import LiteLLM. Simply having the package installed was enough.
What it took. Researchers say the stealer went after cloud credentials, SSH keys, CI/CD secrets, credentials for AI development tools, browser data and environment variables, and on LiteLLM proxy servers, the stored provider API keys and model configuration. It sent them to a lookalike domain, litellm[.]dev.
The backdoor. A second payload started a background process that checked a GitHub-hosted file every hour and ran whatever code the attacker pointed it at. That GitHub account has since been removed.

How the attacker got in

LiteLLM’s director of security said the malicious actions were carried out through three engineers’ GitHub accounts, apparently using stolen GitHub CLI OAuth tokens. In his account, the attacker used one account to trigger the release workflow and another to approve it. The involved tokens have been revoked, and the team removed all but one unaffected user from its GitHub organization as a temporary measure. The company has also said it doesn’t yet know how the tokens were obtained, so it can’t rule out further access. That investigation is ongoing, and we will treat anything beyond it as unconfirmed.

Twice in a year

This is not the first time. In March, LiteLLM versions were backdoored in an incident that security reporting ties to a campaign called TeamPCP, and that one also used a startup path file to run its stealer. The March incident and this one have not been proven to have the same cause, and we haven’t seen evidence either way. What both show is that the project, and the release pipeline around it, is a target worth repeated attention.

Why an AI gateway is such a good target

We wrote recently about what an LLM proxy is. The relevant point here is what it holds. A gateway like this typically stores the API keys for every AI provider a team uses, often alongside model settings and database credentials, and it runs on servers or build machines that also hold cloud and deployment secrets. One compromise reaches a lot at once.

It concentrates keys. Steal one gateway’s configuration and you may hold keys for several providers, with spending power attached.
It sits in privileged places. Developer laptops, CI runners and production servers all carry secrets beyond the AI keys.
It is widely depended on. Many teams install it as a library or run it as a container, so a bad release travels fast, often without anyone choosing to upgrade by hand.

If you installed it

Follow the advice of the security firms and the LiteLLM team rather than ours. The consistent guidance in the reports is to treat any host that installed 1.107.0, or ran a container pulled while it was live, as compromised, to revoke and replace credentials from a clean environment, and to pin a known-good version, with 1.106.2 named as clean, by digest. Researchers also stress that rotating AI provider keys alone is not enough, because the stealer targeted far more than those. If you aren’t sure whether you were affected, check LiteLLM’s official security notice and the indicators published by the researchers listed below.

Habits that limit the damage

None of these stop a determined attacker, but each one makes a bad release cost less.

Pin and verify. Lock exact versions and hashes, so a new release can’t arrive unannounced.
Wait a little. Avoid taking a brand-new release the day it ships. A short cooling-off period gives researchers time to catch problems. Reports note that this release was pulled within about two hours, so even a day of delay would have avoided it.
Give each tool its own key. Use separate API keys per app, with spending limits, so one theft doesn’t give access to everything.
Shrink what a build can see. Use short-lived credentials and keep production secrets away from build and test machines.
Watch outbound traffic. A stealer has to send data somewhere. Unexpected connections from a build or server are worth investigating.
Check provenance when it exists. Researchers noted that PyPI showed no provenance attestations for this release. Where packages offer them, they are a useful signal.

If you only use apps

You don’t install LiteLLM, but the same logic applies to any app where you paste in your own AI provider key. Use a key with a spending limit, don’t reuse it across services, and rotate it if a vendor you rely on discloses a breach. We named LiteLLM as an example of an open-source gateway in our earlier guide. That was not an endorsement, and we have added an update note there.

Sources

For disclosure: we are not security professionals, and this is general information, not advice for your setup. We have no inside knowledge of this incident. Facts are drawn from the reports above and from LiteLLM’s statements as quoted in them, and may be updated as the investigation continues.

More from Offgrid Studio

What Is Your AI App Sending? Watching LLM Traffic
AI Agents Broke Out of Their Tests: What We Know
What a Hospital for Coding Agents Teaches About Review

Back to the blog