LiteLLM Hack Exposes Secrets From 2,488 Companies Across 118,829 CI Runner Dumps

Gbhackers •Mayura Kathir • August 13, 2026

The LiteLLM supply-chain compromise has shifted from a short-lived malicious package incident into a sprawling enterprise exposure event. Analysis of an alleged 153GB attacker archive has linked 118,829 CI runner dumps to 2,488 corporate domains, exposing the depth of secrets accessible inside modern build environments. The campaign, publicly attributed to TeamPCP, began upstream of LiteLLM. […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

LiteLLM Supply Chain Attack Exposes Thousands of Companies to Cyber Threats In March 2026, the LiteLLM AI software was compromised through a malicious upload to PyPI, lasting approximately 40 minutes. This breach allowed attackers to target 2,500 companies and 434,000 CI/CD pipelines, risking build systems, cloud accounts, and source code. The attack exploited vulnerabilities in the release process of trusted software components, highlighting the growing threat to AI infrastructure as a strategic target for credential theft and software supply chain abuse. The incident underscores the need for enhanced security measures in developer tooling and supply chain management. As of today, the attack's full impact is still being assessed, and organizations are urged to review their security protocols. 14 sources 65

Extracted Entities

LiteLLM Hack Exposes Secrets From 2,488 Companies Across 118,829 CI Runner Dumps

The full story

Extracted Entities

APT Groups (1)

Attack Types (1)

CWE Weaknesses (1)

MITRE ATT&CK (1)