Cybersecurity

The LiteLLM Breach Sat Hidden for Five Months

CloudSEK links a March 2026 LiteLLM compromise to 2,500+ firms and 434,000 CI/CD pipelines. The attack beat a safeguard developers still trust, and the FBI says the credentials are still usable.

CybersecurityBy Servola Tech Desk2026-08-134 min read

AI-assisted, edited by humans. | Editor-in-Chief: Leon Soliman | Editorial standards

The LiteLLM Breach Sat Hidden for Five Months

Key takeaways

Threat actor group TeamPCP compromised LiteLLM's build pipeline in March 2026 by first hijacking the Trivy security scanner through a leaked automation token, then force-pushing malicious code into Trivy version tags that LiteLLM's CI pipeline pulled in unpinned.
The poisoned LiteLLM packages, versions 1.82.7 and 1.82.8, were live on PyPI for roughly 40 minutes before removal - long enough for a malicious .pth file to execute at Python interpreter startup, which bypasses the --ignore-scripts flag developers rely on as a standard defense against malicious installs.
Security firm CloudSEK published research on August 11, 2026 tying the compromise to more than 2,500 organizations and roughly 434,000 exposed CI/CD pipelines worldwide, with high-confidence matches including Siemens AG, Siemens Energy, Deutsche Bahn AG, Orange S.A., Vodafone Group Plc, London Stock Exchange Group, Fortum Oyj and Munich Re.
The FBI issued a FLASH advisory in July 2026 warning that credentials harvested in the March intrusion - SSH keys, AWS, GCP and Azure tokens, Kubernetes secrets and AI provider API keys - remain usable and are likely to be weaponized in later, unrelated attacks.
CloudSEK stresses that appearing in its exposure dataset does not confirm a company was breached, only that its credentials, domains or infrastructure showed up in the harvested data - meaning named organizations need to independently verify exposure rather than assume the finding is definitive.

What Happened Inside LiteLLM's Build Pipeline in March

The intrusion did not start with LiteLLM itself. TeamPCP first compromised the Trivy open-source security scanner by exploiting a leaked automation token, gaining roughly a 20-day window inside Trivy's own repository before anyone noticed. During that window, the group force-pushed malicious code into Trivy's version tags - the specific release markers that downstream projects point to when they pull a dependency.

LiteLLM's continuous integration pipeline installed Trivy without pinning it to a fixed, verified version, so it automatically pulled the poisoned release the next time the pipeline ran. That single unpinned dependency was the entire opening TeamPCP needed: the malicious code rode into LiteLLM's own build process, and from there into two published packages, LiteLLM versions 1.82.7 and 1.82.8, uploaded to the Python Package Index.

The Defense Everyone Trusts, and How It Was Bypassed

Most developers who worry about malicious PyPI packages rely on the --ignore-scripts flag, which stops a package's install-time scripts from running arbitrary code. TeamPCP's payload did not need an install script. It shipped inside a .pth file, a Python path-configuration file that the interpreter itself executes automatically at startup, on every run, regardless of how the package was installed. That design choice is the detail every headline about this breach left out, and it is the one that matters most to any engineering team that thought --ignore-scripts made them safe from this exact attack class.

Once running, the payload harvested SSH keys, cloud credentials for AWS, Google Cloud and Azure, Kubernetes tokens, the contents of .env files, and AI provider API keys from any machine that had installed the poisoned package. The stolen data was encrypted with AES-256 and sent either to a typosquatted domain built to look like a legitimate LiteLLM or Trivy resource, or uploaded directly into repositories on the victim's own GitHub account - a detail that let the operation blend into normal-looking developer activity rather than trigger an obvious outbound-traffic alert.

2,500 Companies, Eight Named in Europe, and a Five-Month Gap

CloudSEK published its research on August 11, 2026, five months after the March compromise, identifying more than 2,500 organizations and approximately 434,000 CI/CD pipelines as potentially exposed - what the firm calls the largest AI supply-chain breach uncovered so far in 2026. Among the high-confidence matches CloudSEK names are Siemens AG, Siemens Energy, Deutsche Bahn AG, Orange S.A., Vodafone Group Plc, the London Stock Exchange Group, the Finnish energy company Fortum Oyj and the reinsurer Munich Re, spanning manufacturing, telecommunications, rail, finance and insurance across multiple European jurisdictions.

CloudSEK is explicit that a company appearing in its dataset is not automatic proof of a successful breach - the finding means credentials, domains, repositories or infrastructure tied to that organization surfaced in the harvested exposure data, and each organization needs its own investigation to confirm what, if anything, was actually taken or misused. What is not in question is the five-month gap between the March intrusion and the August disclosure, a window in which any of the named organizations could have been operating on infrastructure with compromised credentials and no public warning that the compromise had happened.

What This Means for Anyone Running AI Infrastructure Tooling

The FBI's July 2026 FLASH advisory adds an uncomfortable detail to the timeline: the credentials harvested in March are still considered live and usable months later, and the bureau expects TeamPCP or affiliated actors to weaponize them in future, unrelated intrusions rather than let them expire. For any organization that ran LiteLLM versions 1.82.7 or 1.82.8 in production or CI during March 2026, the correct response is not to wait for individual confirmation from CloudSEK or LiteLLM - it is to treat every credential that touched that build pipeline as compromised and rotate it now, five months late or not.

The structural lesson extends past LiteLLM. Any organization that lets its CI pipeline pull a security-tooling dependency, such as a scanner, without pinning it to a verified version has the same opening TeamPCP used here, and --ignore-scripts is not the safeguard most teams believe it to be against a payload delivered through a .pth file. European security leads running AI infrastructure tooling built on the same open-source supply chain should treat this less as a LiteLLM story and more as a preview of how the next AI-tooling compromise will most likely be delivered.

Frequently asked questions

What is LiteLLM and why does its compromise matter beyond one company?

LiteLLM is a widely used open-source gateway that lets developers call many different AI model providers through one interface, so it sits inside a large number of companies' AI infrastructure. A compromise of its build pipeline can reach every organization that installed the poisoned package versions, which CloudSEK puts at more than 2,500.

How did the attackers get around the --ignore-scripts safeguard?

They placed the malicious payload inside a .pth file, a Python path-configuration file the interpreter executes automatically at startup on every run. That execution method does not rely on a package's install-time scripts, which is what --ignore-scripts blocks, so the flag offered no protection against this specific technique.

Which named European companies were flagged as high-confidence matches?

CloudSEK's research names Siemens AG, Siemens Energy, Deutsche Bahn AG, Orange S.A., Vodafone Group Plc, the London Stock Exchange Group, Fortum Oyj and Munich Re, among other organizations worldwide, as high-confidence matches in the exposure dataset.

Does appearing in CloudSEK's dataset mean a company was definitely breached?

No. CloudSEK states explicitly that inclusion in the dataset means the organization's credentials, domains, repositories or infrastructure were identified in the harvested exposure data, not that a confirmed breach occurred - each organization needs to investigate independently.

Every write-up of this breach led with the number 2,500. The number that should worry a European CISO more is 40 - the minutes the poisoned packages needed to be live on PyPI to reach that scale - and five, the months between the intrusion and CloudSEK's disclosure. A defense built around --ignore-scripts and a five-month detection window built around a third-party research vendor's blog post is not a defense against this attack class, it is a description of why this attack class works. The FBI's own advisory says the stolen credentials are still live. Rotating them is not optional because CloudSEK named your organization; it is necessary because TeamPCP's window into a compromised CI pipeline does not close on its own.

LiteLLMsupply chain attackCloudSEKPyPICI/CDcredential theftAI infrastructure

Riot's $9.1 Billion AI Tenant Has No Name

Riot Platforms disclosed a $9.1 billion, 191 MW Rockdale data center lease in its SEC filing without naming the tenant. Bloomberg says Anthropic. Neither has confirmed it.

3 min read

Infrastructure

6,144 GPUs Are Live, Not the 70,000 Promised

Firebird's Armenia AI factory went live August 8 with 6,144 NVIDIA Blackwell GPUs, a fraction of the 70,000-plus GPUs and 2 gigawatts still on the roadmap for 2027 and 2028.

4 min read

Decisions

The Third Pivot Was the Warning Magic Leap Missed

Magic Leap filed a WARN notice for 193 layoffs effective 1 October 2026, its fourth strategic pivot after $4 billion raised. The lesson is the pattern, not the pivot.