> ## Content Index > Fetch the complete content index at: https://thecoverwire.com/llms.txt > Use this file to discover other available public pages before exploring further. # Poisoned LiteLLM release was on PyPI for under two hours - URL: https://thecoverwire.com/litellm-supply-chain-compromise-cyber-aggregation/ - Published: 2026-11-04T11:17:38.000Z - Updated: 2026-11-04T11:17:38.000Z - Description: A poisoned release of an open source AI gateway shows how one software supply chain compromise could reach many cyber policyholders at once. - Author: CoverWire - Tags: Analysis, AI, #desk-risk **Analysis** | By CoverWire, created using AI A poisoned release of LiteLLM, open source software that many firms use as a single gateway to AI models, was live on the Python Package Index for about an hour and three quarters on 21 October. The question for cyber underwriters is whether a compromise like this behaves like one firm's breach or like an aggregation event. CoverWire's analysis is that it sits closer to the second, because the stolen secrets are keys to paid services. ## Key points - LiteLLM says a malicious version 1.107.0 was on PyPI from 12:39 to 14:23 UK time on 21 October, with Docker images affected for about two and a half hours. - It says the malware steals credentials, and tells anyone who installed it on a host with internet access to assume their secrets were taken. - CoverWire's analysis: AI gateways hold many provider keys in one place, so one bad release can hit many insureds at the same time. - LiteLLM has published no count of downloads or victims, and no claims have been reported. ## What LiteLLM has said The facts here come from LiteLLM's [incident report](https://docs.litellm.ai/blog/security-incident-oct-21-2026?ref=thecoverwire.com), first published on 21 October and updated on 23 and 30 October. The company says the PyPI package litellm 1.107.0 was available from 11:39 to 13:23 UTC. Four Docker image tags, including "latest", were compromised from 11:46 to 14:20 UTC. LiteLLM says the official 1.107.0 source tag on GitHub did not contain the malicious files. It says the bad artifacts were built from an attacker-controlled repository. Its enterprise private registry was not affected. Users who installed the bad version are told to rotate everything the host could reach, including the cloud access role, every model provider key stored in the proxy database, the master and virtual keys, the database password and any secret in the environment. If the host had outbound internet access, LiteLLM says to assume the data was stolen. The original report also describes how the attacker got in. LiteLLM's 23 October update says some early assumptions in the post later proved inaccurate or incomplete, and points readers to a separate canonical record. The account below comes from the original post. A privileged developer's credential was used to override branch protection, a second account's credential passed a production approval gate, and a third account deleted workflow records. LiteLLM suspects the tokens were exposed in logs on an internal system that was reachable from the internet. That cause is LiteLLM's own working view, and the company says it is still confirming parts of it. ## Why this looks like aggregation This part is CoverWire's interpretation. A gateway like LiteLLM exists to hold keys for several AI providers and hand them out to internal apps. A stolen gateway key is less like a stolen password and more like a stolen company card. The idea that an AI key lets an attacker buy computing on the victim's bill was raised by Nate B. Jones in [a post on AI agents and cybersecurity](https://natesnewsletter.substack.com/p/ai-agents-cybersecurity). That points to three possible heads of loss: incident response and key rotation, unexpected AI usage bills, and any data reached with the stolen credentials. Whether a surprise usage bill counts as a covered loss under a given cyber wording is unverified. It may depend on whether the wording treats it as funds transfer fraud, as extra expense, or as neither. Because the same release reached anyone who updated in that window, the losses would share one cause and one date. That is the pattern that cyber aggregation scenarios try to capture. ## The other explanation There is a less alarming reading. The window was short. Firms that pin software versions would not have pulled a new release within two hours. On that view, this was a near miss that tested key rotation habits, not a market event. Both readings fit the public facts. LiteLLM has published no figures on how many installs took place, so the size of the exposed population is unverified. ## What it suggests for underwriting CoverWire's analysis is that proposal forms that ask about patching and multi-factor authentication may say little about this risk. The more useful questions are whether a firm pins third-party packages, whether AI provider keys sit behind spending limits, and how fast it can rotate every secret in one go. Related coverage: [NCSC: four routes behind 88% of large-firm incidents it handled](https://thecoverwire.com/ncsc-annual-review-88-percent-four-access-routes/). ## Sources - [LiteLLM, security incident report, 21 October 2026, updated 23 and 30 October](https://docs.litellm.ai/blog/security-incident-oct-21-2026?ref=thecoverwire.com) - Idea credit: [Nate B. Jones, "AI Agents and Cybersecurity", 24 October 2026](https://natesnewsletter.substack.com/p/ai-agents-cybersecurity)