Your AI gateway logs every prompt and response so you can debug and audit. LiteLLM believes that is exactly where an attacker found the keys to its release pipeline.

On 21 October, LiteLLM disclosed that its release pipeline had been compromised and used to push version 1.107.0 to PyPI, Docker Hub and GHCR. The PyPI wheels were live from 11:39 to 13:23 UTC. LiteLLM says the attacker held three developers’ GitHub CLI OAuth tokens, one belonging to one of its two GitHub organisation owners. Its timeline shows branch protection rejecting an unauthorised workflow change at 10:08:29 UTC, and that owner-level credential overriding the protection five seconds later. The modified workflow then built signed artifacts from a lookalike repository, Berri-AI/litellm. A third account then deleted the workflow records. Where did the tokens come from? LiteLLM says it has observed specific situations in which Claude Code embeds a user’s GitHub CLI OAuth token in a response body, which can then land in gateway logs. It found an unexpected account on its internet-exposed internal LiteLLM deployment and believes the attacker took the tokens from those logs; how that access was gained is not yet confirmed.

According to the OpenSSF malicious-packages entry on OSV, the wheels dropped cook.pth, cook.py and sitecustomize.py so the code ran at every Python start, stealing cloud, Kubernetes, CI and AI-tool secrets and polling hourly for new code to run. BleepingComputer reports that even running Python or pip to investigate re-triggered it, and that LiteLLM sees 92 million monthly PyPI downloads.

No phishing email and no MFA prompt. A coding agent’s session token was recorded by an AI gateway, the gateway was reachable from the internet, and a long-lived developer token outranked the branch protection meant to stop it. We treat AI gateways as plumbing. They are credential stores: they hold provider keys and, by LiteLLM’s account, can capture whatever the agents behind them pass along. For APAC teams racing to put a central gateway in front of every model, logging defaults are now an identity decision. On the same day, GitHub shipped an opt-in preview of expiring, auto-refreshing GitHub CLI tokens, so that, in its words, “a leaked access token becomes unusable within hours instead of lasting indefinitely.”

What security leaders should do:

• If litellm 1.107.0 or the affected Docker tags ran anywhere, follow LiteLLM’s guidance: treat the host as compromised, pin 1.106.2, rebuild, and rotate every credential it could reach.
• Audit AI gateway logging. Turn off response-body logging where you don’t need it, scrub what is stored, and treat gateway logs as secrets.
• Take internal AI gateways off the public internet and review their accounts.
• Move developers to GitHub CLI v2.103.0 with gh auth login --expiring, and rotate any token that may have passed through an agent or gateway.
• Reduce standing organisation-owner rights, and alert on branch-protection changes and deleted workflow runs.

Every log you keep for the AI is also a log someone else can read.

Disclaimer: This post was researched and written by AI agents working with Philip Sow. Every source is linked so you can check the facts. Views are personal and do not represent any employer.

#AISecurity #SupplyChainSecurity #IdentitySecurity #AgenticAI #CyberSecurity

Sources: LiteLLM · OpenSSF Malicious Packages via OSV · BleepingComputer · GitHub Changelog