What happened?

Terabytes worth of credentials have been exposed in a supply-chain attack on LiteLLM, an open source tool that streamlines AI-driven software development. Many belong to the world's biggest and most sensitive organisations: Microsoft, Amazon, Cisco, Samsung and Salesforce are only a handful of the entities whose access secrets were exposed.

The revelation was posted by security firms CloudSEK and Hudson Rock. CloudSEK said it found cloud keys, repository tokens, SSH keys, Kubernetes secrets, package publishing credentials, environment variables and AI provider keys that could allow attackers to gain access to more than 2,500 organisations.

40 minutes was enough

The credentials were extracted during a 40-minute window in March, while the victims used compromised versions of LiteLLM downloaded from the package's official location in the Python Package Index repository. Hudson Rock said it made the discovery after analysing a 195TB file it had obtained. Neither firm identified the source of the information.

In all, roughly 434,000 CI/CD software pipelines had credentials exposed after running the compromised LiteLLM versions during that 40-minute span.

Where the chain starts

The LiteLLM compromise was itself the result of a previous supply-chain attack: one that infected the widely used vulnerability scanner Trivy. Other software infected in the campaign includes KICS and the Telnyx Python SDK.

TeamPCP, a ramshackle but extremely capable gang largely made up of teenagers, took credit for the attack, and researchers have largely corroborated the claim.

In figures

  • Exfiltration window: 40 minutes, in March
  • Organisations affected: more than 2,500
  • Pipelines affected: roughly 434,000 CI/CD pipelines
  • File analysed: 195 terabytes
  • Start of the chain: Trivy; also KICS and the Telnyx Python SDK
  • Types leaked: cloud keys, repository tokens, SSH keys, Kubernetes secrets, environment variables, AI provider keys

How it worked

The compromised versions of all four software packages contained code that accessed the memory of infected machines, scraped its contents and exfiltrated it through an attacker-controlled channel. Interspersed in the resulting wall of data are credentials to software pipelines maintained by the tens of thousands of organisations that ran LiteLLM during those 40 minutes.

In many cases researchers had trouble identifying which organisation the credentials belonged to. An email address in the dump from the domain @siriusxm.com, for instance, ultimately did not indicate a breach at the satellite broadcaster but rather one within the infrastructure of SiriusXM subsidiary AdsWizz.

Why does it matter?

Independent security researcher Kevin Beaumont said he had confirmed the data was legitimate across multiple victim organisations: "It contains a significant volume of sensitive content at orgs. It's a massive supply chain breach due to poor AI security — not because AI is the threat, but teens can run circles around orgs obsessed with rushing out AI and poor DevOps security."

That assessment also frames the episode: what broke here was not a model's security but the security of the software pipeline using that model. AI tools entering the development process quickly means unvetted dependencies enter just as quickly.

What is not settled

Neither security firm identified the source of the leaked data. A full list of affected organisations was published, but researchers could not determine which organisation some records belonged to; the count of affected organisations should therefore be read as a lower bound.