Supply-Chain Attack on AI Tool Exposes Terabytes of Corporate Credentials
A massive supply-chain attack on LiteLLM, an open-source tool that streamlines AI-driven software development, exposes terabytes of sensitive credentials belonging to thousands of organizations. Security firms CloudSEK and Hudson Rock reveal that cloud keys, repository tokens, SSH keys, Kubernetes secrets, and AI provider keys are among the data stolen from over 2,500 entities. Major corporations including Microsoft, Amazon, Cisco, Samsung, and Salesforce count among the victims whose access secrets are compromised.
The credentials are extracted during a 40-minute window in March while victims use compromised versions of LiteLLM downloaded from the official Python Package Index repository. Hudson Rock uncovers the breach after analyzing a massive 195TB file. The attack stems from a previous supply-chain compromise that infects widely used tools including the Trivy vulnerability scanner, KICS, and the Telnyx Python SDK. The infected packages contain code that accesses machine memory, scrapes its contents, and sends the data through attacker-controlled channels.
A hacking group called TeamPCP, largely composed of teenagers, claims responsibility for the attack, and researchers corroborate the claim. Independent security researcher Kevin Beaumont confirms the leaked data is legitimate and contains a significant volume of sensitive organizational content. He notes that the breach highlights critical gaps in AI security practices, emphasizing that organizations rushing to deploy AI tools lack adequate DevOps security protections. The incident underscores how even young, unsophisticated actors exploit weak security postures to devastating effect.