The LiteLLM breach was a March 2026 supply chain attack in which criminals compromised LiteLLM's build pipeline, stole its package publishing credentials, and shipped two malicious versions of the open source AI gateway that stayed live on PyPI for about 40 minutes. According to CloudSEK's 2026 analysis, the compromised releases reached more than 2,500 organizations and exposed roughly 434,000 CI/CD pipelines before anyone caught it. If your AI agents, Copilot extensions, or internal chatbots route through a third-party gateway you didn't build yourself, this is the incident that should change how you vet that vendor.
LiteLLM is not an obscure tool. It's the proxy layer thousands of companies use to route calls from their applications to OpenAI, Anthropic, Azure OpenAI, and a dozen other model providers through one API, and the package has been downloaded more than 95 million times. That popularity is exactly why the attack worked at this scale.
A 40-minute window turned into the largest AI supply chain breach on record.
The attack started somewhere most security reviews never look: a vulnerability scanner. The group behind the breach, tracked as TeamPCP, had already compromised Trivy, a widely used open source security scanner, using stolen maintainer credentials. LiteLLM's own build pipeline installed Trivy automatically as part of its CI process, which handed the poisoned scanner read access to the runner environment, including LiteLLM's PyPI publishing tokens.
A compromised logging library or a bad npm package is bad enough. A compromised AI gateway is worse, because of where it sits. LiteLLM and tools like it sit between every application and every model provider in your stack, which means they hold the API keys, cloud credentials, and often the raw prompts and completions for everything that touches an LLM in your company.
When that layer gets poisoned, the blast radius isn't one application. It's every agent, chatbot, and Copilot extension configured to talk to a model through it. According to Help Net Security's review of the leaked data, the exposure included 153GB of stolen credentials: environment variables, cloud tokens, database connection strings, and API keys sitting in memory or on disk when the poisoned code ran.
If an AI vendor you use can't tell you which model gateway or proxy sits underneath their product, you don't actually know how many other companies' worth of blast radius you're exposed to if that gateway gets breached.
In the vendor security reviews I've sat in on this year, almost none of them asked the AI helpdesk vendor, Copilot add-in provider, or internal automation team what actually sits between their agents and the model provider. After LiteLLM, that question belongs in every vendor security review and every internal architecture review of tools your own engineers built.
| Risk Area | Question to Ask | Red Flag Answer |
|---|---|---|
| Gateway dependency | Do you use LiteLLM or another open source AI proxy, and do you pin exact versions? | "We auto-update to the latest version" |
| Credential exposure | Are model provider API keys stored in the gateway process, or in a separate secrets manager? | "They're in the gateway's environment variables" |
| Build pipeline trust | Do your CI tools, like scanners and linters, get automatically updated without review? | "We haven't audited our build dependencies" |
| Incident response | Would you know within 24 hours if a dependency you rely on was compromised? | "We'd probably find out from the news" |
You don't need a security team the size of a bank's to close most of this gap. Start with the parts you already control directly.
None of this requires ripping out your AI tooling. It requires treating the plumbing underneath it as seriously as you'd treat any other piece of infrastructure with access to your credentials.
According to Kiteworks' 2026 Data Security and Compliance Risk survey, 65 percent of organizations already had a cybersecurity incident caused by an AI agent operating on their network before LiteLLM even happened, and 63 percent say they can't enforce purpose limitations on those agents today. LiteLLM didn't create that exposure. It just showed how fast it can turn into a breach.
Every AI agent, Copilot extension, or internal automation your company runs depends on a chain of open source packages, gateways, and model providers that nobody on your team wrote and most of your team has never looked at.
That chain is now part of your attack surface, whether it shows up on your asset inventory or not.
We talk through this exact gap with clients building LLM integrations for ServiceNow and Microsoft 365, and it's usually the first thing that surprises a security review.
It was a March 2026 supply chain attack in which criminals compromised LiteLLM's build pipeline through a poisoned Trivy scanner, stole its PyPI publishing tokens, and published two malicious package versions that stayed live for about 40 minutes. According to CloudSEK's analysis, the incident reached more than 2,500 organizations and exposed roughly 434,000 CI/CD pipelines before it was caught.
Possibly. Many AI helpdesk tools, Copilot extensions, and internal chatbots route model calls through LiteLLM or a similar open source gateway under the hood without advertising it. Ask any AI vendor you use what sits between their product and the model provider, and whether that layer pins dependency versions instead of auto-updating.
Check whether any system in your environment installed LiteLLM versions 1.82.7 or 1.82.8 between March 24, 2026 and the patch that followed, and rotate any credentials reachable from that system's environment. If a vendor built your AI tooling, ask them directly rather than assuming they already checked.
An AI gateway is a proxy layer, like LiteLLM, that routes API calls from your applications to model providers such as OpenAI, Anthropic, or Azure OpenAI through a single interface. It typically holds the API keys and credentials for every model your company uses, which makes it a high-value target: compromise the gateway and you compromise everything that talks to it.
No. It means treating the software underneath your AI agents with the same scrutiny you'd apply to any other vendor with access to your credentials: ask for a bill of materials, pin dependency versions, scope agent permissions tightly, and rotate keys on a schedule instead of never.
We'll map every gateway, proxy, and dependency your AI agents actually run through, and tell you honestly where the exposure is before an incident finds it for you.
Talk to UsFree 2-minute assessment. Get an industry-specific score and action plan — no call required.