Glonce

LiteLLM supply-chain attack exposes credentials from 2,500+ orgs

securityThe Glonce editorsArs Technica🔥83Glonce rating83Impact85Novelty75Relevance95Surprise70Players75Credibility88
LiteLLM supply-chain attack exposes credentials from 2,500+ orgs

Security firms CloudSEK and Hudson Rock disclosed on Tuesday and Wednesday that terabytes of credentials had been exposed in a supply-chain attack on LiteLLM, an open-source tool used to streamline AI-driven software development. Microsoft, Amazon, Cisco, Samsung and Salesforce are among the organizations whose access secrets turned up in the leak.

CloudSEK said it found cloud keys, repository tokens, SSH keys, Kubernetes secrets, package publishing credentials, environment variables and AI provider keys among the exposed material, and that the haul could let attackers reach more than 2,500 organizations. The credentials were pulled during a 40-minute window in March, while victims were running compromised versions of LiteLLM downloaded from the package's official listing on the Python Package Index. Hudson Rock said it made its discovery by analyzing a 195TB file it had obtained; neither firm said where the file came from.

The LiteLLM compromise traces back to an earlier supply-chain attack on Trivy, a widely used vulnerability scanner. The same campaign also infected KICS and the Telnyx Python SDK. TeamPCP, described as a ramshackle but capable gang made up largely of teenagers, claimed credit for the attack, and researchers have largely backed up that claim.

Independent security researcher Kevin Beaumont said he had checked the data himself and confirmed it as legitimate across multiple victim organizations, calling it a massive supply-chain breach rooted in poor AI-development security rather than any inherent threat from AI itself.

Key facts

  • CloudSEK and Hudson Rock disclosed a supply-chain attack on LiteLLM that exposed terabytes of credentials, with CloudSEK saying access could reach more than 2,500 organizations.
  • Victims whose secrets were exposed include Microsoft, Amazon, Cisco, Samsung and Salesforce.
  • Credentials were extracted during a 40-minute window in March from victims running compromised LiteLLM packages pulled from the official PyPI listing.
  • The compromise stems from an earlier supply-chain attack on the Trivy vulnerability scanner that also infected KICS and the Telnyx Python SDK; TeamPCP, a gang largely made up of teenagers, claimed credit and researchers have largely corroborated it.
  • Independent researcher Kevin Beaumont personally verified the leaked data as legitimate across multiple victim organizations.

Why it matters

LiteLLM is a widely used open-source tool for building AI-driven software, so a compromise of its official PyPI package turned an ordinary developer dependency into a route straight into the cloud infrastructure of thousands of organizations. The exposed material was not one narrow secret type but the whole set an attacker needs to move around inside a victim's systems: cloud keys, repository tokens, SSH keys, Kubernetes secrets, package publishing credentials, environment variables and AI provider keys.

Who it affects

CloudSEK says the exposed secrets could allow attackers to reach more than 2,500 organizations, with Microsoft, Amazon, Cisco, Samsung and Salesforce named among them. In practice, anyone who ran the compromised LiteLLM package during the 40-minute window in March is a potential victim, as are users of Trivy, KICS or the Telnyx Python SDK, the other tools hit by the same broader campaign.

How to use it

This is a security disclosure, not a product to adopt. Organizations that ran LiteLLM, Trivy, KICS or the Telnyx Python SDK around the affected period should treat cloud keys, repository tokens, SSH keys, Kubernetes secrets, package publishing credentials, environment variables and AI provider keys tied to those tools as potentially exposed and rotate them.

How solid is it

Two independent security firms, CloudSEK and Hudson Rock, reported the leak within a day of each other, and Hudson Rock says its findings came from directly analyzing a 195TB file it obtained. Independent researcher Kevin Beaumont said he personally confirmed the data as legitimate across multiple victim organizations. Researchers have also largely corroborated TeamPCP's claim of responsibility for the attack.

Risks and caveats

Neither CloudSEK nor Hudson Rock has identified where the 195TB file came from, and no absolute calendar date is given for either the disclosure, reported only as "Tuesday and Wednesday," or the extraction window, reported only as "in March." There is no total count of individual leaked credentials, only that the volume runs to terabytes, and none of the named organizations, Microsoft, Amazon, Cisco, Samsung or Salesforce, is reported to have commented or responded.

“It contains a significant volume of sensitive content at orgs. It's a massive supply chain breach due to poor AI security, not because AI is the threat, but teens can run circles around orgs obsessed with rushing out AI and poor DevOps security.”

— Kevin Beaumont, independent security researcher