I have been warning about AI supply chain attacks for years. Today the bill arrived, and it is bigger than almost anyone predicted.<\p>
Last week, cybersecurity researchers disclosed that a threat actor group known as TeamPCP had compromised LiteLLM, one of the most widely used open-source AI proxy gateways. The attack was not a brute-force break-in. It was a supply chain poisoning operation that moved through a trusted security tool and into thousands of continuous integration pipelines worldwide.<\p>
The numbers are staggering. More than 2,500 organisations and over 430,000 CI/CD pipelines were affected. The malicious releases, LiteLLM versions 1.82.7 and 1.82.8, were published to PyPI after attackers stole the project’s publishing credentials. The payload used a .pth Python startup hook, meaning the malicious code executed the moment the Python interpreter initialised, even if LiteLLM was not explicitly imported. That is clever, quiet, and devastatingly effective.<\p>
How the Attack Unfolded
The chain started five days earlier with a different target. TeamPCP first compromised the GitHub Actions pipeline for Trivy, a popular open-source vulnerability scanner. LiteLLM’s own CI/CD pipeline used Trivy. The poisoned scanner ran with legitimate read access to LiteLLM’s runner environment, allowing attackers to silently exfiltrate the PyPI publishing tokens.<\p>
Armed with those tokens, the attackers published two malicious versions of LiteLLM within minutes of each other. The three-stage payload immediately began harvesting environment variables, local configuration files like .kube/config and .aws/credentials, attempted lateral movement across Kubernetes clusters, and installed a persistent systemd backdoor.<\p>
Every developer machine, production server, or CI/CD pipeline that executed the compromised package had its live environment memory and configurations harvested mid-execution. Researchers found plaintext cloud infrastructure keys, GitLab and GitHub personal access tokens, SSH keys, and AI provider API keys sitting in the captured data. The victims included major global organisations: Orange, Boeing, Roku, and Samsung.<\p>
Why This Is Different
We have seen supply chain attacks before. The difference here is the target. LiteLLM is not just another Python library. It is an AI gateway that routes traffic to roughly 100 different AI services. Compromising LiteLLM gives attackers access to the AI infrastructure of thousands of organisations in a single move. This is not a single door being picked. It is the master key to the entire AI wing.<\p>
Also, the attack started from a security tool. Trivy is designed to find vulnerabilities. When a vulnerability scanner becomes the attack vector, trust in the entire software supply chain ecosystem erodes. Every developer who ran Trivy in their pipeline during that five-day window is now a potential secondary target.<\p>
What to Do Right Now
If your organisation uses LiteLLM, treat every secret accessible to its environment as compromised. Rotate AWS, GCP, and Azure IAM keys immediately. Rotate Kubernetes service account tokens, GitLab and GitHub personal access tokens, and any AI provider API keys that passed through LiteLLM.<\p>
Check your installed LiteLLM version. Versions 1.82.7 and 1.82.8 are malicious. Pin to a known clean version, ideally 1.82.6 or earlier, and audit any environments that ran the compromised versions during the exposure window.<\p>
Audit your CI/CD pipeline dependencies. The Trivy compromise shows that upstream tooling is a blind spot for most security teams. Review every GitHub Action, build plugin, and automated scanner your pipelines use. If you do not know what they can access, assume they can access everything.<\p>
The Bigger Picture
This incident is the AI supply chain breach the industry has been predicting since 2024. LiteLLM is just the first widely documented case. The pattern will repeat. Every popular open-source AI tool, gateway, and framework is now a target. The economics are too attractive: one compromised dependency gives attackers access to hundreds or thousands of downstream organisations with AI budgets large enough to make the payoff significant.<\p>
The same week this broke, the US House Democrats pressed OpenAI and Anthropic about rogue AI agents that created fake identities during security tests. North Korean hackers were revealed to be building local AI environments for attack automation. IBM’s 2026 Cost of a Data Breach Report showed AI-enabled breaches up 56 percent, averaging $6 million each. The threat landscape is not a collection of isolated incidents. It is a coordinated shift in how attacks are launched, and the supply chain is the preferred entry point.<\p>
Organisations that treat AI as just another application tier are missing the point. AI infrastructure is not the same as a web server or a database. It touches more data, calls more external services, and moves faster than traditional security reviews can keep pace with. The LiteLLM breach proved that a single compromised dependency in that infrastructure can cascade across the global enterprise AI estate in hours.<\p>
The organisations that survive the next twelve months are not the ones with the most AI tools. They are the ones that know exactly what AI tools they have, what those tools can touch, and whether every dependency in the chain has been verified.<\p>
Related Reading
A Single Dodgy Character Just Broke Millions of AI Agents<\p>
North Korean Hackers Are Building Local AI Tools to Automate Attacks<\p>
Could Your Organisation Withstand a Cyberattack Accelerated by AI?<\p>
