SUPPLY CHAIN COMPROMISE
LiteLLM, March 2026: a compromised scanner poisoned an AI gateway
TeamPCP compromised the Trivy CI pipeline, used that access to obtain LiteLLM's PyPI publishing tokens, and shipped a credential stealer in two releases of a package with roughly 95 million monthly downloads.
What this was
Confirmed supply chain compromise, disclosed by LiteLLM and analysed by several vendors. The compromise was of build and publishing infrastructure, not of a model or an agent. It is included here because the package is AI infrastructure and the stolen material was the credentials AI systems run on.
What happened
On 24 March 2026, PyPI releases 1.82.7 and 1.82.8 of LiteLLM were published containing malicious code. LiteLLM stated that initial evidence suggested the attacker bypassed official CI/CD workflows and uploaded packages directly to PyPI, and that the compromise originated from the Trivy dependency used in its CI/CD security scanning workflow. The payload scanned for environment variables, SSH keys, cloud provider credentials for AWS, GCP and Azure, Kubernetes tokens and database passwords, then encrypted and exfiltrated them by POST to models.litellm.cloud, a domain LiteLLM confirmed is not theirs. The packages were live from 10:39 UTC for approximately 40 minutes before PyPI quarantined the project. Users of the official LiteLLM Proxy Docker image were unaffected, because it pins dependencies rather than resolving from PyPI. A clean 1.83.0 followed on 30 March via a rebuilt pipeline. The campaign is attributed to TeamPCP, also linked to the Trivy and Checkmarx compromises.
Why an agent changes the risk
The chain is the lesson: a vulnerability scanner in CI was the way into an AI gateway. Security tooling runs with credentials and runner access, which makes it a high-value target rather than a safe dependency. And the payload was not interested in models at all, it took the cloud and cluster credentials that an AI gateway necessarily holds. An LLM proxy is a concentration of secrets before it is anything else.
How to test for this
- Test what your CI runners can reach and what they hold. A compromised build step is an attacker with your publishing tokens, and in this case a scanner in one project reached the publishing rights of another.
- Treat an AI gateway as a secrets store, because it is one. Enumerate what a compromise of it would yield: provider keys, cloud credentials, whatever is in the environment.
- Verify that a 40 minute window matters to you. Pinned and hash-verified dependencies made this a non-event for Docker image users and a credential rotation exercise for everyone else.
Other cases
CONFIRMED INTRUSION
Hugging Face, July 2026: an autonomous agent ran the intrusion end to end
A malicious dataset chained two code-execution paths into node-level access and lateral movement across internal clusters, driven by an attacker framework that executed roughly 17,000 individual actions.
CONFIRMED INTRUSION
Vercel, April 2026: a small third-party AI tool became everyone's problem
An attacker compromised Context.ai, then used an employee's Google Workspace OAuth grant to reach Vercel's internal systems and decrypt non-sensitive environment variables.
COORDINATED DISCLOSURE
Opening a repository was enough: pre-trust execution in a coding agent
A repository-controlled config file made a coding agent run attacker commands before its own trust dialog appeared, turning cloning a project into code execution.
CONTROLLED EVALUATION
OpenAI Operator: indirect prompt injection becomes an action risk
OpenAI’s published red-team work shows how untrusted content can influence a browser-using agent that can operate tools or move data.
CONTROLLED EVALUATION
Anthropic’s agentic-misalignment evaluation: model access can resemble an insider threat
Anthropic’s fictional corporate simulations test what can happen when a tool-using model has sensitive context, external actions, and a deliberately constructed goal conflict.
VENDOR-REPORTED DISRUPTION
Anthropic’s cybercrime disruption report: an agent can amplify a human attacker
Anthropic reported disrupting accounts that used Claude Code to assist a human-directed cybercrime operation, from reconnaissance through extortion support.
COORDINATED DISCLOSURE
nullifAI: malicious PyTorch models evaded pickle scanning on Hugging Face
Researchers found two Hugging Face-hosted model files with malicious pickle payloads that could reach web shells when loaded in an unsafe environment.