SCIENCE AND TECH
There is a special kind of horror reserved for the realization that something has been broken for months and nobody knew. That is the story unfolding across boardrooms and security operations centers this week, as researchers reveal that a single 40-minute window back in March quietly became what may be the largest AI infrastructure breach of 2026 — a breach so deep it reached into the software pipelines of some of the biggest names in tech, defense, banking and manufacturing on Earth.
The tool at the center of it all is called LiteLLM. If you have never heard of it, you are in good company — most people outside of software engineering hadn't either, until this week. But inside the AI industry, LiteLLM is something close to plumbing: an open-source "gateway" that lets companies route requests to different AI models — OpenAI's, Anthropic's, Google's, whichever — through a single, unified system. It is the kind of unglamorous infrastructure that sits quietly in the background of thousands of companies' AI operations, doing its job, until someone realizes it has been turned into a Trojan horse.
According to a bombshell report from Indian threat-intelligence firm CloudSEK, that is exactly what happened. And the fallout is still being counted.
The 40 Minutes That Broke the Internet's Trust
The attack traces back to March 2026, when a hacking group researchers have named "Team PCP" pulled off what CloudSEK describes as a three-tool-deep chain reaction. It started, improbably, with Trivy — a widely used open-source security scanner that is supposed to catch vulnerabilities, not create them.
Team PCP had already compromised Trivy's GitHub Action and release process. That compromised version of Trivy sat inside LiteLLM's own build pipeline for roughly 20 days, undetected, because — in a detail that will make DevOps engineers everywhere wince — LiteLLM's CI/CD pipeline had installed Trivy without "pinning" it to a specific, verified version. In plain English: the system was set to automatically trust whatever the latest version of Trivy happened to be, no questions asked. That trust was the opening the attackers needed.
Once inside, the poisoned scanner stole the pipeline's PyPI publishing token — essentially the master key that lets LiteLLM's maintainers push new versions of their software out to the world. With that key in hand, Team PCP published two malicious versions of LiteLLM, numbered 1.82.7 and 1.82.8, to the Python Package Index, the massive public repository that software developers around the globe pull code from every single day.
Those two poisoned packages were live for approximately 40 minutes before they were caught and pulled. Forty minutes. But in the world of automated software pipelines — where machines install, build and deploy code at speeds no human could match, often with sweeping system privileges — 40 minutes was more than enough time for the damage to spread across the globe like ink in water.
CloudSEK put it bluntly in its report: the attack chain was "Trivy, then the build system, then the LiteLLM release: one un-revoked token, three tools deep."
What Got Stolen — And Why It's So Bad
Buried inside those two malicious LiteLLM packages was malware researchers have dubbed the "SANDCLOCK Stealer." Once it landed inside a company's CI/CD pipeline — the automated assembly line that builds and ships modern software — SANDCLOCK went to work harvesting anything of value it could find: SSH keys, AWS credentials, Google Cloud and Microsoft Azure access tokens, Kubernetes cluster secrets, CI/CD platform secrets, and — perhaps most alarmingly, given the tool it was hiding inside — AI-provider API keys.
Those are not passwords to some throwaway forum account. These are the literal keys to a company's cloud infrastructure: the credentials that let software deploy itself, access databases, spin up servers, and move data around. In the hands of a skilled attacker, stolen cloud credentials can be the difference between "we got hacked" and "we got robbed, spied on, and sabotaged, all at once."
CloudSEK says it has reconstructed an exposure dataset spanning more than 2,500 organizations and roughly 434,000 individual CI/CD pipelines. High-confidence matches in that dataset include some of the most recognizable corporate names on the planet: Nvidia. Amazon Web Services. Cisco Systems. Salesforce. Siemens. X Corp, the company formerly known as Twitter. Orange, the French telecom giant. Samsung. Volkswagen. Deloitte. The list spans finance, telecommunications, manufacturing and — worryingly — defense contractors.
Researchers say they've now obtained a staggering 153 gigabytes of stolen credential data linked to the breach, pulled from 118,829 individual CI runner environment dumps across nearly 2,500 organizations. To put that in perspective, 153 gigabytes is roughly the size of dozens of feature-length movies in high definition — except instead of movies, it's a sprawling archive of the digital keys to some of the world's biggest companies.
"Not Just A Software Breach — A Warning Shot"
CloudSEK's researchers are not mincing words about what this incident represents for the broader AI industry. "AI gateways, like LiteLLM, are becoming the junctions of digital operations," the firm said in its report.
"The incident was not only a software supply chain breach that happened to involve an AI product," CloudSEK stated. "It demonstrated that compromising an AI control point can expose the identities and systems around it."
That is the part that should worry every company racing to bolt AI tools onto their existing operations. As AI gateways and orchestration tools become the connective tissue linking a company's cloud infrastructure, its internal data, and the outside AI models it relies on, they become extraordinarily attractive targets — a single point of compromise that can radiate outward into everything else. "Future attacks are likely to target the AI layer precisely because it is connected to everything else," CloudSEK warned.
And the danger, researchers stress, didn't end when the malicious packages were pulled from PyPI after those 40 fateful minutes. "Removal does not end the incident," CloudSEK noted. "A package can disappear in minutes while copied credentials remain usable for weeks or months unless they are rotated and downstream activity is investigated."
That warning was echoed at the federal level. Back in July, the FBI issued a FLASH advisory — tracked as FLASH-20260702-01 — cautioning that threat actors could still weaponize credentials harvested in this breach long after the original March intrusion. Five months on from the initial compromise, the bureau says further downstream supply chain attacks remain a very real possibility. In other words: this story is not over. It may just be getting started.
How Nobody Noticed For Five Months
Perhaps the most unsettling part of this saga is the timeline itself. The compromise happened in March. It is now mid-August. That's roughly five months in which a piece of stolen-credential malware sat inside the software supply chains of thousands of organizations, with nobody the wiser, before security researchers pieced together what had happened and how far it had spread.
Part of the explanation lies in how modern software actually gets built. Few humans ever look at every line of every open-source package their company relies on — there are simply too many, updating too fast, for that to be realistic. Instead, companies lean on automation: scanners like Trivy that are supposed to flag danger before it spreads. When the scanner itself becomes the attack vector, as it did here, that entire safety net collapses from the inside, and the malicious code can ride along inside routine, everyday software updates that nobody thinks twice about.
It also reflects something uncomfortable about the AI boom more broadly. As companies stampede to integrate large language models into their products — often at breakneck speed, with security review as an afterthought — the tools that make that integration possible, like LiteLLM, are being bolted onto sensitive infrastructure faster than security teams can properly vet them.
Expert Perspective
Security researchers who have reviewed CloudSEK's findings describe the LiteLLM breach as a case study in how "supply chain" risk has evolved in the AI era. Traditional supply chain attacks — like the infamous SolarWinds breach of 2020 — targeted software that companies knowingly installed and controlled. AI gateway tools like LiteLLM occupy a stranger, more privileged position: they sit between a company's own systems and the outside AI providers it depends on, often carrying broad permissions by design, because that's what makes them useful. That same design choice is what made this breach so damaging once the gateway itself turned hostile.
Analysts covering the incident also note a grim symmetry: the very AI boom that has made tools like LiteLLM indispensable has also made them irresistible targets, precisely because so many companies now route sensitive operations, and sensitive credentials, through a small number of shared open-source projects.
What This Means For You
If you don't work in software, this might feel like a story about companies, not people — but the ripple effects reach further than you'd think. Many of the organizations named in the exposure dataset — banks, telecoms, defense contractors, major consumer tech companies — hold your data, run the apps on your phone, or provide services you rely on daily. Stolen cloud credentials at that scale can, in the worst case, lead to further breaches of customer data, service outages, or compromised products down the line, sometimes months after the original incident, exactly as the FBI warned.
If you work in tech, even in a small company, the lesson is more direct: any open-source tool your business depends on, especially ones with deep system access like AI gateways, needs the same security scrutiny you'd give a vendor handling your customer data — because increasingly, that's exactly what they are.
For everyone else, the LiteLLM breach is a reminder of something that's easy to forget in the age of instant AI chatbots: behind every slick AI feature is a tangle of software infrastructure, built by overworked engineering teams, held together by trust in tools most users will never see — and that trust, this week, proved to be worth exactly 40 minutes.
The Bottom Line
Five months after a 40-minute window in March, the world is only now grappling with the scale of what happened when hackers turned a trusted AI tool into a weapon against the companies that relied on it. With 153 gigabytes of stolen credentials now circulating, an FBI warning still active, and researchers cautioning that "removal does not end the incident," the LiteLLM breach may go down as the moment the AI industry learned, the hard way, just how much weight its unglamorous plumbing was quietly bearing — and how catastrophic it is when that plumbing bursts.
