이미지: Ars Technica
Summary
- Credentials from more than 2,500 organizations were exfiltrated in terabyte volumes through a compromised version of LiteLLM, an open-source AI development tool
- CloudSEK and Hudson Rock found that during a 40-minute attack window opened last March, credentials from roughly 434,000 CI/CD pipelines were leaked
- The supply chain attack first infected the vulnerability scanner Trivy before spreading to LiteLLM, KICS, and the Telnyx SDK, with the youth-heavy hacking group TeamPCP identified as being behind it
- 유출 규모
- 테라바이트 단위 자격증명, 2,500여개 조직 대상
- 공격 대상
- 오픈소스 AI 개발 도구 LiteLLM (PyPI 배포 버전)
- 공개 시점
- CloudSEK·Hudson Rock, 2026년 8월 11~12일
- 공격 발생 시점
- 2026년 3월, 40분간 노출
- 영향받은 파이프라인
- CI/CD 파이프라인 약 43만4천건
- 피해 조직 예시
- 마이크로소프트, 아마존, 시스코, 삼성, 세일즈포스
- 배후 지목
- TeamPCP (주로 청소년으로 구성된 해킹그룹)
- 감염 확산 경로
- Trivy 스캐너 공급망 공격 → LiteLLM, KICS, Telnyx Python SDK
Someone's AI coding assistant quietly shipped information elsewhere for 40 minutes. In that window, access keys from more than 2,500 organizations — including Microsoft, Amazon, Cisco, Samsung, and Salesforce — were exfiltrated wholesale.
What happened in 40 minutes
Security firms CloudSEK and Hudson Rock disclosed the incident in succession last Tuesday and Wednesday (August 11-12 local time). According to the two companies, an attacker opened a mere 40-minute window last March through a compromised version of LiteLLM, an open-source AI development tool, and during that time siphoned data from the memory of organizations that had downloaded the compromised version from the Python package repository PyPI. Hudson Rock said it confirmed the leak after analyzing 195 terabytes of files.
The leaked material included cloud access keys, repository tokens, SSH keys, Kubernetes secrets, package deployment credentials, environment variables, and even AI provider API keys. Data published by Hudson Rock showed Salesforce's SALESFORCE_CLIENT_SECRET, Slack's SLACK_SIGNING_SECRET, and Microsoft Azure environment information exposed in plain form.
434,000 pipelines breached
The two firms counted roughly 434,000 CI/CD (continuous integration/continuous deployment) pipelines from which credentials leaked. CI/CD is the pipeline that automatically builds, tests, and deploys code once a developer writes it — if these credentials are compromised, an attacker can gain direct access to everything from source code to production servers.
However, both companies said pinpointing exactly which organizations were affected from the leaked data was not straightforward. For instance, numerous emails from the @siriusxm.com domain were found in the data, but the leak was later confirmed to have originated not from satellite broadcaster SiriusXM itself, but from the infrastructure of its subsidiary, AdsWizz.
| Infected software | Role |
|---|---|
| Trivy | Vulnerability scanner, initial point of infection |
| LiteLLM | Multi-LLM API integration tool, the channel for this mass leak |
| KICS | Infrastructure-as-code security scanning tool |
| Telnyx Python SDK | SDK for communications APIs |
The chain began with Trivy
LiteLLM's compromise was not the initial point of entry itself. The widely used vulnerability scanner Trivy was infected first, and the supply chain attack then spread to LiteLLM. In the same campaign, the security tool KICS and Telnyx's Python SDK were also found to have been infected. All four compromised packages contained code that accessed and harvested the memory of infected devices before exfiltrating the contents to channels designated by the attacker.
TeamPCP has been identified as being behind the attack — a loosely organized but reportedly quite capable hacking group made up mostly of teenagers. Independent security researcher Kevin Beaumont, who confirmed the authenticity of the data, said, "It's not that AI is inherently dangerous — it's that companies rushed to adopt AI while leaving security lax."
AI development tools have become a new intrusion vector
LiteLLM is an open-source tool that unifies multiple large language model (LLM) APIs under a single interface, letting developers call different models — from OpenAI, Anthropic, Google, and others — by changing just one line of code. This layer, rapidly adopted by everyone from startups to large enterprises amid the generative AI boom, became the channel for this attack.
Observers note that as companies rush to bolt on AI features, security vetting has been left behind. On August 10, OpenAI announced GPT-5.6-Cyber, a model dedicated to cybersecurity, saying it was building up defensive capabilities — but this incident illustrates the lesson that even such defenses can be rendered powerless once the chain of trust in the supply chain itself breaks down.
So what changes now
No organizations have yet been publicly confirmed to have suffered concrete damage from this leak, but most of the exposed credentials are likely still valid. Organizations that have not updated their LiteLLM version since March should prioritize rotating all related keys and reviewing their access logs. The incident is less a flaw in the AI tool itself than another demonstration of the risk inherent in supply chain structures — where a single compromised open-source package can simultaneously expose tens of thousands of organizations that rely on it. It is likely to be remembered as a case that exposed just how far DevOps security practices have fallen behind the rush to adopt AI features.
