New findings reported on October 24 trace the LiteLLM supply chain attack to a leaked Agent Platform master key that was never revoked. LiteLLM says the key enabled theft of GitHub credentials and the October 21 publication of malicious version 1.107.0 to PyPI and container registries. Microsoft warns that affected Python environments could execute malware without importing LiteLLM, extending exposure beyond active AI gateways.

According to LiteLLM's root-cause report, the key appeared in a public repository on May 27, 2026. The commit was overwritten, but the credential remained valid. On October 10, an attacker used it to retrieve an unrestricted GitHub CLI OAuth token belonging to an organization owner, gaining access across the project's repositories.

Socket independently recovered malicious workflows dated October 10 and 12, establishing activity eleven days before the poisoned release. The attacker created temporary branches, ran jobs designed to collect repository secrets, then deleted the branches. Socket cautions that successful workflow runs alone do not prove delivery of stolen data because the jobs suppressed transmission errors.

LiteLLM says stolen maintainer tokens enabled the attacker to trigger and approve a release after an owner token bypassed branch protection. The build source was redirected to a lookalike repository. The company says it is revoking tokens across internal systems and vendor platforms; its final account supersedes an earlier theory that gateway logs exposed the initial token.

Microsoft's analysis describes Python startup hooks that activated the payload on developer workstations, build agents, test environments and containers. Removing only LiteLLM application files could leave those hooks behind. The malware targeted credentials and included a background component capable of fetching and executing additional code, making package removal alone an incomplete response.

LiteLLM's incident guidance advises rebuilding affected images and virtual environments, removing malicious startup files and stopping the detached Python daemon. If version 1.107.0 was installed on a host with outbound internet access, the project advises assuming exfiltration succeeded and rotating reachable credentials, including cloud roles, provider keys and database passwords. Defenders should also review cloud audit logs for subsequent credential use.