decrypted · 13 august 2026 · ransomware and cybercrime · supply chain · ai and llm security

The LiteLLM breach that leaked 2,500 companies' secrets, and the dependency nobody pinned

Five months after an open-source AI proxy called LiteLLM was quietly poisoned, the bill has come due. This week a researcher firm published its analysis of a 153GB archive lifted from the attackers, containing credentials harvested from roughly 2,500 corporate domains. It is a supply chain story with an AI-shaped twist, and the design failure at its centre is depressingly ordinary.

What actually happened

LiteLLM is a widely used gateway that routes an application's calls to whichever AI model sits behind it, which makes it exactly the kind of infrastructure component nobody thinks about until it breaks. In March, attackers calling themselves TeamPCP compromised the build process of Trivy, a popular open-source vulnerability scanner, by rewriting a Git tag to point at a malicious release. LiteLLM's own CI pipeline pulled Trivy without pinning it to a specific, verified version, so the poisoned scanner ran during LiteLLM's build and quietly exfiltrated the token used to publish packages to PyPI.

With that token, the attackers pushed two malicious LiteLLM releases. The second added a file that Python executes automatically on every interpreter startup, whether or not anything actually imports LiteLLM. Any machine that had recently installed the package, developer laptop or CI runner alike, ran the attacker's code without anyone opening a terminal. Over roughly forty minutes before PyPI pulled the releases, the malware collected AWS, Azure and Google Cloud credentials, SSH keys, Kubernetes tokens and Slack and Salesforce secrets from every environment it touched. It sat in an attacker's archive until this week, when a threat intelligence firm obtained and analysed it, attributing exposed CI runner data to nearly 2,500 corporate domains, including Samsung, Cisco, Salesforce and Siemens.

The Secure by Design lesson

Nothing about this attack was exotic. It worked because of two ordinary, avoidable choices: a build pipeline that trusted a third-party tool without pinning its version, and a publishing token with no scoping or short expiry sitting in a runner that also ran untrusted code. Pin your dependencies, including the security scanner you installed specifically to catch this kind of thing, and treat any token capable of publishing to the world as a secret that should live nowhere near a general-purpose build step. LiteLLM's maintainers have since rebuilt their pipeline around isolated environments with tighter gates, which is the right fix, just five months late for the organisations whose secrets were already in that archive by the time it shipped.

For UK organisations the lesson is not really about LiteLLM. It is that a huge amount of your CI/CD estate runs software you did not write, updated by a process you do not control, with credentials that would let an attacker move sideways into cloud accounts and customer systems. Treat your build pipeline with the same scepticism you'd apply to a stranger asking for your AWS keys, because that is functionally what an unpinned dependency is.

Also this week

DeadLock ransomware has moved its infrastructure onto a blockchain. Microsoft's security team published a breakdown this week of a ransomware operation, active since mid-2025 with around 80 mostly European victims, that stores its leak-site configuration and negotiation chat addresses on the Polygon blockchain rather than a conventional server. That means the usual takedown, seizing a domain or a server, doesn't touch the parts that matter, though the group still depends on a custom proxy and hosted files that remain seizable.

Cisco's firewall software has a live, unauthenticated crash bug. CVE-2026-20349 lets an attacker knock over ASA and FTD devices running Remote Access VPN with a single crafted HTTP request, no login required. CISA added it to its exploited-vulnerabilities list on 11 August and gave US federal agencies until 14 August, tomorrow, to patch. There is no workaround, only the update.

Taiwan says it was hit by a fully AI-agent-run attack. Taiwan's government reported that up to eight autonomous AI agents, built on the open-source OpenClaw framework, mapped 21 government systems and chained together attack techniques with no human in the loop for stretches of the operation. Officials called it the first disclosed case of a government being attacked this way. UK defenders should read it as a preview, not a curiosity.

Sources

If any of this touches your own build pipeline or vendor exposure, get in touch.

More like this

Get the next post by email: subscribe to Decrypted. Double opt-in, unsubscribe any time, or take the RSS feed.

Prefer to listen? Decrypted on Apple Podcasts, or paste the podcast feed into any app.