The 2026 LiteLLM Supply Chain Breach Explained: How a 40-Minute Hack Exposed 2,500+ Companies. A research report by cybersecurity firm CloudSEK revealed the largest AI supply-chain attack of 2026. The attack, linked a threat group known as Team PCP, the incident secretly infected a popular AI framework and exposed over 2,500 organizations and 434,000 automated software build pipelines worldwide.
1. What is LiteLLM and Why Do Companies Use It?
To understand how this attack worked, it helps to understand first LiteLLM and its role in modern software development:
- The AI “Translator”: LiteLLM is an open-source Python tool that acts as a central gateway. Instead of writing custom code to connect to OpenAI, Anthropic, Google Gemini, or AWS Bedrock separately, software developers use LiteLLM as a single translator to manage all AI models in one place.
- The Automated Software Factory (CI/CD Pipelines): Modern tech companies rely on Continuous Integration and Continuous Delivery (CI/CD) pipelines. These act like automated factory assembly lines that automatically pull in code, run tests, and publish software.
Because LiteLLM can be integrated directly into automated software development pipelines, it may have access to highly sensitive resources, including API keys, cloud credentials, and other confidential secrets.
2. What Actually Happened? (40 minute Window)
The attack was fast, automated, and required zero interaction from developers or users.
1. Upstream Compromise: Threat actors initially compromised the Trivy security scanner used inside LiteLLM’s build setup, inadvertently harvesting the project’s PyPI publishing tokens.
2. Poisoning the Repository: Using these stolen tokens, Team PCP released two backdoored updates (‘1.82.7’ and ‘1.82.8’) to the Python Package Index (PyPI) containing a hidden credential stealer.
3. The 40-Minute Window: The malicious updates were available on PyPI for approximately 40 minutes before being removed.
4. Automated Mass Download: Despite the brief window, thousands of automated CI/CD software pipelines worldwide pulled down the poisoned versions during routine automated software builds.
5. Instant Execution: The malware was engineered to trigger automatically as soon as Python initialized, meaning build environments were infected even if developers never explicitly imported the bad code in their applications.
3. What Was the Impact?
The malware systematically swept through infected build environments to harvest high-value infrastructure secrets.
What Was Exposed?
- Cloud Infrastructure Keys: Access credentials for Amazon Web Services (AWS), Google Cloud, and Microsoft Azure.
- AI API Keys: Stolen secrets for OpenAI, Anthropic, and central AI gateway configurations.
- Container & System Secrets: Kubernetes cluster tokens, SSH keys, repository credentials, and hidden environment variables.
- Unintentional Public Leaks: In instances where direct data transmission to attacker servers failed, the malware created a public repository inside the victim organization’s own GitHub account and uploaded the stolen credential dumps as public release assets. Consequently, multiple companies unknowingly leaked their own internal passwords publicly.
CloudSEK cofounder, Rahul Sasi said, “The victim list is dominated by major AI and technology companies, with relatively few non-tech organizations, with relatively few non-tech organizations. That does not mean non-tech companies being safe. Most of them consume AI from the companies that were hit. If a vendor on that list held their data or API keys, they’re exposed through it. The impact is the same, it’s just difficult to attribute.”
Who Was Affected?
CloudSEK’s analysis found strong evidence of exposed data linked to several major companies around the world, including:
- Technology & Cloud: NVIDIA, Samsung Electronics, Cisco Systems, Salesforce, ServiceNow, Zscaler.
- Industrial & Aerospace: Siemens, Airbus, Volkswagen, John Deere, Thales Group, Bosch.
- Finance & Professional Services: Deloitte, S&P Global, London Stock Exchange Group (LSEG).
- Telecom & Media: Vodafone, X Corp (Twitter), Orange S.A., BT Group.
(Note: CloudSEK points out that being listed in the exposure dataset means an organization’s automated pipeline ran the affected code. But, this does not prove that attackers stole data or gained active access to the company’s internal systems.)
4. What Companies Must Do?
Deleting the compromised LiteLLM package does not secure an organization.
An FBI FLASH advisory (FLASH-20260702-01) warns that threat actors affiliated with Team PCP are actively archiving stolen credentials to weaponize them long after the initial breach. Because a stolen cloud password or API key remains valid until explicitly revoked, the security threat persists far beyond software cleanup.
Essential Security Remediation Steps:
1. Immediate Credential Rotation: Security teams must immediately invalidate and reissue all cloud IAM keys, database credentials, Kubernetes tokens, and AI API keys exposed in LiteLLM build environments in March 2026.
2. Purge Build Caches: Clear package caches in GitHub Actions, GitLab CI, and Jenkins, and rebuild underlying runner images.
3. Audit GitHub Repositories: Check corporate GitHub organizations for unauthorized public repositories or unexpected release assets created during the breach window.
4. Verify Exposure Status: CloudSEK has released a free tool enabling security teams to check whether their CI/CD runs were part of the exposed dataset, using CloudSEK’s free Exposure Checker tool.
