LiteLLM’s Breach Started With a Key Nobody Revoked for Five Months

A credential leaked in May detonated in October — and LiteLLM’s own verification advice turned out to be wrong four days after they gave it

Vortex 404

5 min read

·

6 days ago

--

Listen

Share

Overview

LiteLLM published a postmortem tracing its October 21, 2026 supply-chain compromise — a poisoned release that shipped a credential stealer and a backdoor to PyPI and Docker Hub — back to a root cause that happened five months earlier and sat quietly unaddressed the entire time: an admin key accidentally committed to a public GitHub repository on May 27, 2026, that nobody revoked. The gap between that leak and its actual use is the real story here, more than the malware itself.

Press enter or click to view image in full size

The chain, start to finish

• May 27, 2026 — An admin key is accidentally committed to the public LiteLLM-Labs/lite-harness repository. It stays live and unrevoked.
• October 10, 2026 — An attacker uses that five-month-old key to gain access to LiteLLM’s internal Agent Platform and extracts a GitHub CLI OAuth token from it.
• October 21, 2026 — Using stolen GitHub CLI OAuth tokens belonging to three separate engineers — one of them carrying organization-owner privileges — the…