LiteLLM Says Hackers Found GitHub Tokens Claude Code Left in Its Logs, Then Used Them to Poison a Release

LiteLLM, the open source gateway companies use to route traffic to OpenAI, Anthropic and other model providers, shipped a poisoned release on October 21. Version 1.107.0 contained compiled malware that steals credentials and loads remote code execution tools.

The twist is in the company's own explanation. LiteLLM believes the attackers broke into an internal deployment of its own product, which was exposed to the public internet, and lifted developers' GitHub tokens straight out of its logs. A tool built to manage AI keys became the place the keys leaked.

Three stolen accounts, one release

According to LiteLLM's incident post, the malicious PyPI package was live from about 11:39 to 13:23 UTC. The Docker images tagged v1.107.0, latest, main-latest and main-stable were compromised from 11:46 to 14:20 UTC. Enterprise customers on the private release were not affected, and the safe version to pin is 1.106.2.

The official source on GitHub was clean. The artifacts were built from a lookalike repository, Berri-AI/litellm instead of BerriAI/litellm.

LiteLLM had hardened its pipeline after an earlier incident in March. But on Monday, October 19, it temporarily expanded release permissions so two internal engineers could publish daily bugfix backports for customers. Two days later the attacker held three sets of developer GitHub CLI credentials. One belonged to one of the company's two GitHub organization owners and was used to disable branch protections and force push a workflow change. A second account approved the production release. A third deleted the workflow run records, limiting the logs left behind.

Where the tokens came from

LiteLLM says it found "an unexpected, innocuously named user account" in its internal deployment. It has also "observed specific situations in which Claude Code will embed a user's GitHub CLI OAuth token into a response body, and in situations where response bodies are logged, these tokens may appear in LiteLLM logs."

The company has not described those situations, says it is still confirming parts of its account, and suspects the attacker got in "through a recently patched vulnerability." That remains unconfirmed. Still, the theory points at an uncomfortable fact: AI gateways log what passes through them, and coding agents pass secrets.

A stealer built for AI shops

The malicious version was downloaded about 49,000 times, Wiz reported from ClickPy data. That counts downloads, not victims. Wiz says the payload shows "strong indications of LLM-aided development," with verbose names, overly defensive error handling and dead code. It used both a .pth file and sitecustomize.py to run every time Python starts, which Wiz says "appears to be the first documented case in the wild."

The stealer went after LiteLLM's own database table of stored provider API keys. About 4.5 hours after exfiltration, Wiz saw stolen AWS credentials being tested with calls listing Bedrock foundation models. That pattern fits LLMjacking: running AI models on someone else's cloud bill.

Aikido's analysis lists the rest of the haul: browser passwords, SSH keys, shell history, AWS, Azure and GCP credentials, Kubernetes tokens, CI/CD secrets, every environment variable, and config files for Claude Code, Cursor, GitHub Copilot, Windsurf, Gemini CLI and Codex CLI. Data went to an attacker domain posing as litellm.dev, and a backdoor checked in hourly for new code to run.

PyPI quarantined the version, the Docker images were removed, and GitHub took down the attacker's dead drop repository, The Hacker News reported. Anyone who installed 1.107.0 should assume their credentials are compromised. LiteLLM says to rotate the cloud role, every provider key stored in the proxy database, master and virtual keys, and the database password.

It has been a bad week for anyone holding AI credentials. Railway had already told every user to rotate their keys after a breach it tied to attacks on AI inference providers. Now one of the gateways that sits in front of those providers has been turned into a collection point for the same kind of keys.

Some offers on this page may be paid placements or contain affiliate links.