Terabytes of sensitive credentials from over 2,500 organizations were exposed in a supply-chain attack targeting LiteLLM, an open-source tool for AI-driven software development. Security firms CloudSEK and Hudson Rock reported the incident Tuesday and Wednesday, identifying Microsoft, Amazon, Cisco, Samsung, and Salesforce among affected entities.
The credentials were exfiltrated during a 40-minute window in March while organizations ran compromised LiteLLM versions downloaded from the Python Package Index, a primary distribution channel for Python software.
CloudSEK identified the exposed secrets: cloud keys, repository tokens, SSH keys, Kubernetes secrets, package publishing credentials, environment variables, and AI provider keys. Such credentials grant attackers deep access to corporate infrastructure and development environments.
Hudson Rock's analysis of a 195TB file revealed the compromised packages contained code to access and scrape memory contents from infected machines, systematically exfiltrating data through attacker-controlled channels. The data dump included credentials to software pipelines from tens of thousands of organizations.
The LiteLLM compromise was not isolated. It followed a prior supply-chain attack on Trivy, a widely used vulnerability scanner. The broader campaign also impacted KICS and the Telnyx Python SDK, exposing systemic vulnerabilities across multiple development tools.
TeamPCP, described as a group largely composed of teenagers, publicly claimed responsibility. Security researchers corroborated the claim.
Independent researcher Kevin Beaumont verified the leaked data's legitimacy, calling it a "massive supply chain breach due to poor AI security." He noted that organizations rushing AI deployment were leaving themselves exposed to attackers with basic capabilities.
Approximately 434,000 continuous integration/continuous delivery pipelines had credentials exposed. These pipelines—critical for automated software deployment—were compromised after running the infected LiteLLM versions.
CloudSEK and Hudson Rock faced challenges identifying all affected organizations. Many CI/CD pipelines are configured generically, Hudson Rock stated, meaning exposed environment variables posed direct operational risk. Attackers could disrupt software development, inject malicious code, or escalate privileges within enterprise systems.
The incident exposes a widening gap between the speed of AI adoption and the security practices governing development infrastructure. As enterprises race to integrate AI into their toolchains, they are inheriting the vulnerabilities of open-source ecosystems designed before AI-scale data exfiltration became a standard attack vector.
