Reported by 5 outlets

Timeline

1. original reporting

   LiteLLM Supply-Chain Breach Blast Radius: 2,500+ Organizations and 434,000 CI/CD Pipelines

   malware.news · 64d ago · August 11th, 2026

   CloudSEK's analysis of the LiteLLM AI supply-chain compromise — orchestrated by Team PCP in March 2026 by pushing a malicious package to the popular LLM gateway — reconstructs exposure across more than 2,500 organizations and roughly 434,000 CI/CD pipelines worldwide. The short-lived malicious package created standing risks to cloud credentials, source-code repositories, Kubernetes environments, package registries, and AI services downstream of build and deploy chains. Organizations using LiteLLM or its dependents should rotate cloud credentials, audit pipeline secrets, and review Kubernetes access as if the dependency chain was compromised.

   ---

2. update from malware.news

   2,500+ Companies and 434,000 CI/CD Pipelines Exposed in the Largest AI Supply Chain Breach of 2026

   malware.news · 64d ago · August 11th, 2026

   CloudSEK’s latest research examines the LiteLLM AI supply-chain attack, which potentially exposed 2,500+ organisations and 434,000 CI/CD pipelines worldwide. The report details the risks to cloud credentials, source-code repositories, Kubernetes environments and AI infrastructure, while highlighting how compromised AI dependencies can create enterprise-wide security exposure. Authors : Article Link: 2,500+ Companies and 434,000 CI/CD Pipelines Exposed in the Largest AI Supply Chain Breach of 2026 | CloudSEK

3. update from cyberpress.org

   LiteLLM Package Compromise Can Expand Into Repositories, Clusters, Registries and Cloud Accounts

   cyberpress.org · 63d ago · August 11th, 2026

   CloudSEK said the March 2026 campaign was linked to Team PCP and involved compromised releases of LiteLLM versions 1.82.7 and 1.82.8 on PyPI. The packages were reportedly available for around 40 minutes, but the impact window may be much longer because stolen credentials can remain valid after a malicious package is removed. However, inclusion in the dataset should not be treated as proof of compromise. It indicates that an organization may have been exposed to an affected package, pipeline, or credential path and should validate its environment privately. CloudSEK listed several major companies as high-confidence organization-level exposure matches. The classification refers to the strength of the match, not confirmed malicious execution, credential theft, or attacker activity. Organizations must investigate logs, pipeline histories, package downloads, and credential usage before determining whether an incident occurred. The risk comes from the permissions available to an affected process. A developer workstation or CI runner may contain cloud credentials, GitHub or GitLab tokens, SSH keys ,

4. update from gbhackers.com

   LiteLLM Attack Shows AI Infrastructure Is Becoming a Strategic Software Supply Chain Target

   gbhackers.com · 63d ago · August 11th, 2026

   It demonstrated how an upstream breach in developer tooling can turn AI infrastructure into a high-value conduit for credential theft, cloud intrusion, and downstream software supply chain abuse. The packages were available for roughly 40 minutes before quarantine, but their brief […] The post LiteLLM Attack Shows AI Infrastructure Is Becoming a Strategic Software Supply Chain Target appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .

5. mentioned by securityweek.com

   Over 2,500 Organizations Impacted by LiteLLM Supply Chain Attack

   securityweek.com · 62d ago · August 12th, 2026

6. update from malware.news

   Largest AI Supply Chain Breach of 2026: LiteLLM Hack Impacts Thousands of Global Enterprises – Claim Your Ethical Disclosure

   malware.news · 62d ago · August 12th, 2026

   Largest AI Supply Chain Breach of 2026: LiteLLM Hack Impacts Thousands of Global Enterprises – Claim Your Ethical Disclosure The cybersecurity landscape is currently reeling from one of the most sophisticated multi-ecosystem supply chain campaigns publicly documented to date. Orchestrated by a threat actor group known as “TeamPCP,” this cascading attack ultimately compromised LiteLLM – a widely adopted open-source AI proxy gateway – leading to the silent exfiltration of deep developmental secrets from thousands of continuous integration and continuous deployment (CI/CD) pipelines worldwide. Skip directly to the free domain look-up tool to claim your ethical disclosure The Mechanics of the Attack: From Poisoned Scanner to AI Gateway Excellent forensic research publis

7. update from cyberpress.org

   LiteLLM Supply Chain Breach Spreads Credential Stealer Across Thousands of Enterprise CI/CD Environments

   cyberpress.org · 61d ago · August 13th, 2026

   Forensic investigations by Snyk, Trend Micro , and Cycode show that LiteLLM was not the initial target. The attack reportedly began when threat actor TeamPCP compromised the GitHub Actions pipeline associated with Trivy, a widely used open-source vulnerability scanner. LiteLLM developers used Trivy in their own CI/CD workflow. Attackers allegedly used that access to steal PyPI publishing tokens, then used the tokens to release malicious LiteLLM package versions 1.82.7 and 1.82.8. The malicious releases used a Python .pth startup hook. This technique allowed the payload to run automatically when Python started, even if an application did not directly import the LiteLLM library. Such execution makes the attack particularly dangerous because affected developers and automated pipelines may not immediately notice suspicious behavior. LiteLLM Breach Steals CI/CD Credentials The multi-stage payload reportedly collected environment variables and searched for local configuration files. Targeted files included Kubernetes configuration data such as .kube/config and cloud credentials including .aws/credentials . CI/CD environments commonly contain high-value secrets because they automate software builds, cloud

8. update from gbhackers.com

   LiteLLM Hack Exposes Secrets From 2,488 Companies Across 118,829 CI Runner Dumps

   gbhackers.com · 61d ago · August 13th, 2026

   Analysis of an alleged 153GB attacker archive has linked 118,829 CI runner dumps to 2,488 corporate domains, exposing the depth of secrets accessible inside modern build environments.

9. mentioned by securityweek.com

   Trivy, Not LiteLLM Behind the 2,500 Org Compromise

   securityweek.com · 60d ago · August 14th, 2026

10. update from blog.gitguardian.com

    Inside the LiteLLM hack: 153GB, 433,909 Files, 2,488 Organizations

    blog.gitguardian.com · 60d ago · August 14th, 2026

    This week we learned what the attackers stole in that time. On August 12, 2026, Hudson Rock published its analysis of the exfiltration archive: a 153GB RAR containing 433,909 files. CloudSEK published parallel victim research on August 11, covering the same campaign from its own intelligence sources. Neither report is about malware behavior. These are about the loot. The blast radius, now measured In March we wrote about the LiteLLM supply chain attack when the infostealer harvested everything an attacker could want. The archive turns it into counts. On each compromised runner, the payload escalated to root. It swept SSH keys, AWS, GCP, and Azure credentials, Kubernetes service account tokens, .env files, and CI/CD secrets. On AI builds, it also took LLM API keys and gateway configuration, which is access to an organization's entire model stack rather than one credential. Five months later, the qualifier is gone. What is inside the dump Hudson Rock's write-up shows envi