A forgotten key to LiteLLM's AI agent platform coughed up the GitHub owner's token. Eleven days later, a poisoned LiteLLM release hit PyPI

An AI agent platform needs a GitHub token to open pull requests. LiteLLM gave its one the owner's keys to everything, then left the platform's own master key in a public repo.

What happened

On 27 May a config file holding the master key to LiteLLM's internal Agent Platform, an experimental tool that lets self-hosted cloud agents file PRs, landed in a public repository. The team spotted it and force-pushed the commit away, but the key was never revoked. The platform's GitHub credential wasn't a service account. It was the GitHub CLI token of the organisation's owner, not scoped down. On 10 October an attacker used the old master key, asked the API for its list of managed agents, and got that owner token back in the reply.

The damage

That same night, throwaway branches ran CI workflows that posted repository secrets to an outside webhook, handing over tokens for two more maintainers, and the runs were deleted. On 21 October the attacker overrode branch protection, pointed the release workflow at a lookalike fork and approved the production gate with a stolen maintainer token. Seven poisoned litellm 1.107.0 wheels went up on PyPI, plus Docker images, carrying a credential stealer that could fire just by starting Python. Wiz counts about 49,000 downloads.

How it was caught, and what happened next

A community member flagged it on GitHub within half an hour. PyPI quarantined it 103 minutes after the first wheel went up, and LiteLLM says it is revoking every token it has.