A March 2026 attack on the open AI gateway LiteLLM has affected significantly more companies than previously known. The security firm CloudSEK now puts the number of affected companies at over 2500 and the affected CI/CD pipelines at around 434,000. According to CloudSEK, the identified organizations include Nvidia, Amazon Web Services, Cisco, Salesforce, telecom group Orange, and Germany’s Siemens.
Compromised scanner injects malicious code into AI gateway
The origin of the attack chain traces, according to Unit 42 at Palo Alto Networks, to the group TeamPCP, which compromised the open-source security scanner Trivy in March 2026. Using a leaked automation token, the attackers injected malicious code into Trivy’s build chain and through it reached the Python package of the AI gateway LiteLLM, which developer teams use to route requests to different language models through one interface. On March 24, they uploaded two manipulated LiteLLM versions, 1.82.7 and 1.82.8, to the Python Package Index, PyPI.
The packages stayed live for only about forty minutes before the registry blocked them – long enough for automated build systems to download and run them. According to the LiteLLM maintainers’ own security update, the malicious code installed a file called litellm_init.pth that runs automatically on every Python startup and persists on the system. It collected credentials for the cloud services AWS, GCP, and Azure, SSH keys, repository tokens, Kubernetes secrets, and AI provider API keys, and sent them, encrypted, to a domain controlled by the attackers. LiteLLM itself is reportedly downloaded around 3.4 million times a day and serves as a central hub through which companies route calls to different language models — meaning a single poisoned build step could quickly spread into many unrelated systems. Trivy was not the only target, according to Unit 42: the same group manipulated the scanner KICS in the same period and force-pushed code into 76 of 77 version tags of the GitHub Action trivy-action.
CloudSEK puts the toll at over 2500 firms
Five months after the original incident, CloudSEK published its own assessment on August 11, sizing the damage well beyond the initial report. The analysts matched leaked credentials against known company domains and count more than 2500 likely affected organizations across finance, telecom, manufacturing, and defense, spread across roughly 434,000 CI/CD pipelines. The firm has made a searchable overview of its findings public. CloudSEK lists Nvidia, Amazon Web Services, Cisco, Salesforce, Orange, and Siemens as high-confidence hits, alongside dozens of other companies in sectors where stolen cloud and AI access is especially sensitive.
This attribution is independently unverified: it rests on CloudSEK’s own matching, not on confirmation from the named companies. The FBI additionally warned in a flash advisory in July that already-stolen credentials could still be weaponized for new attacks, regardless of whether the affected packages have long since been pulled. For security teams, that means a deleted package does not close out the incident as long as the keys copied back in March haven’t been rotated anywhere.
Maintainers urge immediate credential rotation
Users of the official LiteLLM proxy Docker image were spared, the maintainers say, because that distribution pins dependencies in a requirements.txt file instead of pulling unverified PyPI releases. Anyone who installed the affected versions directly from PyPI is advised by the maintainers to rotate every credential, search the file system for litellm_init.pth, and audit build logs from the affected window. The maintainers also rotated the compromised accounts, paused new releases for a time, and shipped the first release vetted through a newly secured build chain on March 30 as version 1.83.0. The case joins a string of similar attacks on AI tool chains, including the theft of AI access through hijacked npm packages that CrowdStrike documented in August.
It remains unclear how many of the 2500 companies CloudSEK named have already turned the warning into actual key rotations. What the case mainly shows is that a single compromised security tool inside open AI development chains can do damage far beyond its own ecosystem.
