New turn in LiteLLM attack: key from May was not revoked

In October 2026, LiteLLM version 1.107.0 was found to hold malware that steals cloud and AI keys. The last safe version is 1.106.2.

Earlier: Malware in LiteLLM 1.107.0 steals cloud and AI keys

LiteLLM, an open-source AI tool, said on Friday that a key it exposed by mistake in May led to the attack of last week. The company removed the file but did not revoke the key. An unknown attacker used the key earlier this month to get control of all LiteLLM code repositories on GitHub, and then sent out a version with malware that steals logins.

How it works

The exposed file held the master key to an internal tool that runs AI agents. The attacker used it to get an access token for all repositories. Microsoft says the malware started each time Python started, also when the software did not use LiteLLM.

The numbers

• Wiz says the package was downloaded about 49,000 times.
• The package stayed on PyPI, the Python package registry, for about two hours.
• About four and a half hours after the upload, the attacker tested stolen AWS logins to see which AI models they can use.

What is not known

No affected organization has publicly confirmed a breach. The attacker is not named. In March, a different attack hit LiteLLM, and Australian police have charged two men who are alleged members of the TeamPCP group.

Insight: Exposed AI keys are used within hours

LiteLLM left a key live for months after it removed the file. The attacker tested stolen AWS logins about four and a half hours after the upload. Bitsight says a criminal forum sells an attack tool that runs on stolen AI keys, and the key owner pays. This looks like a race where defenders revoke in months and attackers use keys in hours. Leaders must think that each exposed key is stolen.