A supply-chain attack involving the open-source LiteLLM framework potentially exposed more than 2,500 organizations worldwide, according to research from cybersecurity firm CloudSEK.
CloudSEK described the incident as the largest supply-chain attack targeting AI infrastructure identified so far in 2026. Orchestrated by the Team PCP threat actor group in March 2026, the attack affected approximately 434,000 CI/CD pipelines, which are automated workflows that build, test and deploy software code.
The affected software packages were reportedly available for approximately 40 minutes, but the potential consequences extend well beyond that window.
CloudSEK warned:
“The threat is still live: the FBI's July 2026 FLASH advisory (FLASH-20260702-01) warns that affiliated actors are likely to weaponize the harvested credentials long after the original intrusion, which means further supply chain attacks remain a real possibility.”
The attack "highlights how compromised AI dependencies can create enterprise-wide security exposure," the company added.
Malicious Packages Expose Cloud and AI Credentials
CloudSEK found that the compromised packages could expose AWS, Google Cloud and Azure credentials, SSH keys, Kubernetes tokens, CI/CD secrets, package publishing credentials and environment variables.
The researchers also identified potential access to large language model API keys and gateway configurations for AI workloads.
Where the attack failed to extract data, CloudSEK said:
“The malware created a public repository inside the victim's own GitHub account and uploaded the stolen data there as a release asset, meaning some organizations were leaking their own secrets into public view without knowing it.”
CloudSEK also warned that removing the malicious packages does not necessarily end the incident.
“Removal does not end the incident,” the company noted, adding that “a package can disappear in minutes while copied credentials remain usable for weeks or months unless they are rotated and downstream activity is investigated.”
That makes the breach less a one-off package compromise and more a long-tail credential exposure event. Even if the malicious dependency was removed quickly, any secrets harvested during the exposure window may remain usable unless organizations rotate credentials and investigate downstream activity.
Major Enterprises Appear in CloudSEK’s Exposure Dataset
CloudSEK’s reconstructed exposure dataset includes high-confidence matches associated with major organizations including NVIDIA, AWS, Samsung, Salesforce, Cisco, ServiceNow, Siemens, S&P Global, Deloitte, Vodafone, BT, Zscaler and X.
However, the company stressed that a high-confidence match does not establish that an organization was successfully compromised or that an attacker used the exposed credentials.
Instead, it indicates a strong link between an organization or pipeline and the affected supply-chain exposure, requiring further private validation and investigation.
The scale of the potential exposure shows how quickly a compromise in an AI-adjacent development component can create a security investigation spanning cloud infrastructure, software repositories, Kubernetes environments, third-party services and AI systems.
Why the LiteLLM Breach Matters for CX Leaders
The impact of the incident reaches beyond developer tooling.
AI infrastructure increasingly sits between customer data, business applications and systems capable of taking action. AI gateways, model endpoints, agents, vector databases and related services can hold or access credentials for cloud platforms, databases, internal applications and third-party services.
That makes an AI dependency a potential route into a much wider enterprise environment.
CloudSEK stated:
“AI infrastructure is becoming a strategic target. Gateways, agents, vector stores, model endpoints, and MCP servers sit between sensitive data and systems capable of taking action.”
That has implications for customer-facing AI systems that may connect to CRM platforms, knowledge bases, contact center applications, customer records, commerce systems and internal tools.
If credentials available to an AI build or runtime environment are compromised, the potential impact can extend into systems supporting customer interactions, service workflows, customer records and personalized engagement.
CloudSEK pointed to the growing complexity of enterprise AI environments, which can include open-source packages, hosted models, SDKs, connectors, vector databases and third-party services, which creates a broader security problem than a conventional application dependency. A compromised AI infrastructure component may expose not only application secrets, but also model API keys, agent credentials, gateway configurations and access paths into adjacent systems.
CloudSEK identified AI provider access as one potential exposure category, with stolen model API keys and gateway credentials potentially enabling model abuse, prompt or data exposure and unauthorized costs.
In customer-facing environments, those risks can become operational. If an attacker gains access to credentials used by a customer service AI agent, the exposure may touch CRM data, service histories, account details or other sensitive information used to personalize support.
The Credential Problem Is Bigger Than LiteLLM
CloudSEK said credentials accessible to the compromised process should be treated as potentially exposed, including credentials held in process memory, injected into CI/CD jobs, stored on disk or accessible through cloud instance metadata services.
The firm recommends that potentially exposed enterprises rotate cloud, source-control, registry, Kubernetes, SaaS, database and AI credentials. It also advises rebuilding affected environments from known-clean sources and investigating cloud, source-control, package registry and cluster logs.
The company also recommends pinning dependencies and GitHub Actions to verified hashes, reducing credential lifetime and scope, and favoring workload identity over static credentials.
