In its October 23, 2026 root-cause report, LiteLLM traced the first stolen GitHub owner token to an unrevoked master key exposed in a public repository. The key enabled access to LiteLLM’s Agent Platform, setting up the October 21 compromise of release 1.107.0.
How an exposed key led to the compromised release
LiteLLM says a configuration file containing the Agent Platform master key was committed to the public LiteLLM-Labs/lite-harness repository on May 27, 2026. The key was not revoked. On October 10, the attacker used it to access the platform and obtain a GitHub CLI OAuth token belonging to an organization owner. Workflows were then used to exfiltrate tokens belonging to two maintainers.
On October 21, the attacker used the credentials to override branch protection, redirect a staging workflow, and start a production release. LiteLLM’s October 23 report corrected its earlier account that the first owner token came from deployment logs: its investigation traced that token to Agent Platform access instead.
| Date | Event |
| May 27, 2026 | A public repository received a configuration file containing the Agent Platform master key. |
| October 10, 2026 | The attacker used the key to access the Agent Platform and obtain an organization owner’s GitHub CLI OAuth token. |
| October 21, 2026 | The attacker altered LiteLLM’s release workflow and published malicious 1.107.0 artifacts. |
| October 23, 2026 | LiteLLM published its root-cause account, tracing the first owner token to the Agent Platform. |
The release workflow was redirected to the lookalike source repository Berri-AI/litellm, rather than the legitimate BerriAI/litellm. LiteLLM says the official source tag for 1.107.0 did not contain the malicious files. The lookalike repository was the build source, distinct from the Docker Hub and GHCR image tags listed as affected.
Which LiteLLM artifacts were affected
LiteLLM identified all seven PyPI wheels for litellm==1.107.0 as compromised. The wheels were uploaded between 11:39:51 and 11:40:13 UTC on October 21, and PyPI quarantined the package by 13:23 UTC.
On Docker Hub and GHCR, LiteLLM listed the affected tags as v1.107.0, latest, main-latest, and main-stable. The compromised container images were published at 11:46:56 UTC. The affected GHCR tags were unavailable by 13:51 UTC; LiteLLM reported that the Docker Hub tags had been removed or redirected to clean images by 14:20 UTC.
For an exposure review, compare installation and deployment records with the affected package version, image tags, and October 21 UTC windows. A mutable tag such as latest is among the tags LiteLLM identified, so the tag name alone does not identify which image a deployment pulled.
What the payload targeted
Wiz’s analysis says the package placed cook.pth, cook.py, and sitecustomize.py in Python’s site-packages directory. These files were designed to run at Python startup. Wiz described a remote loader intended for Linux and macOS, and a credential stealer that targeted browser data, cloud and AI-service credentials, SSH and GPG keys, shell history, and provider credentials stored in the LiteLLM proxy database.
Wiz cited ClickPy data for an estimate of approximately 49,000 downloads of version 1.107.0. The firm also observed AWS credential validation between 16:20 and 17:01 UTC on October 21, including sts:GetCallerIdentity checks and Amazon Bedrock model-listing calls. Those observations describe credential checks and model listing.
LiteLLM’s guidance for affected environments
LiteLLM advised open-source users to pin version 1.106.2 or another explicit release published before the attack. Its incident guidance also called for checking affected artifacts and startup files, rebuilding affected environments, and rotating secrets accessible from those machines. LiteLLM said customers using its private enterprise registry were not affected by this incident.
