IA · 13 August 2026 · 4 min read
AI Supply Chain Breach: Over 190 Terabytes of Enterprise Credentials Leaked via Compromised LiteLLM Package
In brief: A massive supply-chain attack targeting the open-source library LiteLLM has resulted in the leak of 195 terabytes of highly sensitive corporate credentials. The incident, triggered by a compromised dependency on PyPI, affected more than 2,500 organizations and over 430,000 CI/CD pipelines, exposing cloud keys, API secrets, and repository tokens.
by Team Mocchi's
The aggressive rush to integrate artificial intelligence into software development workflows has just exposed its most vulnerable flank. A devastating supply-chain attack has compromised LiteLLM, one of the most widely used open-source Python libraries for orchestrating and unifying API calls across various Large Language Models (LLMs). The breach opened the doors to internal enterprise systems globally, resulting in the exfiltration of 195 Terabytes of confidential data, including cloud access keys, repository tokens, and continuous integration credentials.
The incident underscores how the eagerness to adopt AI tooling in the software development lifecycle is outpacing standard DevOps security practices, turning tools meant to accelerate development into Trojan horses for cybercriminals.
A 40-minute window with global fallout
As reported by Ars Technica, the attack did not target the AI models themselves, but rather exploited vulnerabilities along the software supply chain. The initial infection stemmed from a compromise of Trivy, a popular open-source vulnerability scanner widely integrated into Continuous Integration and Continuous Delivery (CI/CD) pipelines. By compromising Trivy, threat actors injected malicious code into the official Python Package Index (PyPI) repository, infecting multiple downstream packages including LiteLLM, KICS, and the Telnyx Python SDK.
What makes the breach particularly alarming is the sheer velocity and reach of the impact. The window during which the compromised version of LiteLLM remained available on PyPI lasted a mere 40 minutes in March. However, given the high degree of automation in modern build pipelines that automatically pull package updates, those 40 minutes were enough to infect over 2,500 organizations and compromise more than 434,000 CI/CD build environments worldwide.
Cybersecurity firms CloudSEK and Hudson Rock uncovered the massive 195 Terabyte exfiltration archive. The malicious payload embedded within the infected library performed targeted memory scraping on host build servers during execution, capturing environment variables and API secrets directly from system RAM before transmitting them to attacker-controlled infrastructure.
Tens of thousands of secrets exposed across tech giants
Analysis of the leaked data reveals a detailed map of the internal IT infrastructure of hundreds of enterprises and startups. The exfiltrated material includes Amazon Web Services and Microsoft Azure cloud access credentials, Kubernetes secrets, GitHub personal access tokens, authentication keys for AI providers like OpenAI and Anthropic, and enterprise application secrets for platforms such as Salesforce and Slack.
Among the organizations whose credentials were exposed in the dump are industry giants like Microsoft, Amazon, Cisco, Samsung, and Salesforce. The attack was claimed by TeamPCP, a hacker collective largely composed of teenagers with sophisticated technical capabilities. Independent security researcher Kevin Beaumont confirmed the authenticity of the leaked data, highlighting that the root cause lies in poor DevOps security hygiene: the obsession with shipping AI-powered features quickly led many engineering teams to overlook essential third-party dependency vetting.
The vulnerability of AI wrappers in modern DevOps
LiteLLM and similar packages serve as "wrappers," middleware tools designed to simplify the integration of multiple language models behind a single standardized interface. Because of their central role in modern AI architectures, these tools frequently handle and store highly privileged API tokens and sensitive environment variables.
When a foundational tool like LiteLLM is compromised at the source, the malware gains immediate access to everything processed by the build environment at that moment. The memory-scraping technique deployed by TeamPCP demonstrated that even secrets loaded temporarily into memory for the duration of a single CI/CD job can be intercepted and exfiltrated before the virtual build container is destroyed.
Mocchi's take
The LiteLLM breach offers a stark reminder that AI security extends far beyond prompt safety and model alignment—it begins with rigorous governance of the software supply chain. For engineering teams and businesses adopting AI, relying on open-source wrappers without a structured security strategy introduces significant unmanaged risk. In our custom software and AI integration practices, we enforce a strict baseline: all third-party dependencies must be cataloged, scanned, and routed through mirrored private repositories, complemented by strict secret rotation policies and least-privilege CI/CD access. The speed provided by open-source AI tools is invaluable, but it should never come at the expense of enterprise security.