LiteLLM supply chain breach quietly exposed over 2,500 companies for months before anyone noticed

[Seb93]

CloudSEK has published research showing a March 2026 compromise of the LiteLLM project, a widely used AI gateway library, potentially exposed more than 2,500 organizations and around 434,000 CI/CD pipelines worldwide

The attack chain is the part that really got me, a group called Team PCP first compromised the Trivy security scanner that LiteLLM's own build pipeline relied on, then used that foothold to poison LiteLLM packages on PyPI, the malicious versions were live for only about 40 minutes

Forty minutes sounds trivial until you remember how CI/CD systems work, automated pipelines can pull and execute a dependency within seconds of publication, so a short window is more than enough when the download happens automatically rather than by a human clicking install

The list of high confidence matches CloudSEK flagged includes some very large names, Nvidia, AWS, Cisco, Salesforce, Siemens, Samsung, Deloitte and X among others, though CloudSEK is careful to note a high confidence match is not proof of actual successful compromise, it just means strong evidence the credentials or pipeline touched the exposure

The FBI's FLASH advisory from July is the part that should worry people most, it explicitly warns that stolen credentials from this window can still be weaponized months later, which means plenty of affected organizations may not even know they need to rotate secrets because there is no clean attribution trail pointing back to them

This is basically the nightmare scenario for the AI supply chain, a gateway library sitting right at the choke point between applications and provider API keys got compromised through a dependency of a dependency, and the blast radius is still not fully mapped five months later

2,500+ Companies and 434,000 CI/CD Pipelines Exposed in the Largest AI Supply Chain Breach of 2026 | CloudSEKwww.cloudsek.com

[Undertaker00]

40 minutes on PyPI and 2500 companies exposed is a genuinely terrifying ratio

[Batista]

This is why pinning dependency hashes and not just version numbers actually matters, so many teams skip that step

[Gary98]

Even hash pinning does not save you if the malicious package is what gets published as the new hash though

[CaptainCipher10]

Wonder how many of the 2500 companies still have not rotated credentials at this point

[Bussin]

This should be the wakeup call for treating LLM API keys with the same paranoia as database credentials

[Marnie]

True, the real fix is scanning before promotion to any pipeline that has real credentials attached, not trusting the registry blindly

[ShadowKernel]

Probably a lot honestly, most orgs do not have visibility into which pipelines actually pulled the bad version