Unrevoked LiteLLM key used to publish credential-stealing PyPI package
Microsoft said the malware ran on every Python startup, and stolen AWS keys were checked against Amazon AI models.
76
- Mentions · 7d1
- Mentions · 30d8
- All mentions15
- First seenAug 17, 2026
- Last mentioned5d ago
Timeline
15 articles · newest firstLeaked LiteLLM master key used to steal GitHub tokens and publish malicious 1.107.0
An unrevoked Agent Platform key from May let an attacker publish LiteLLM 1.107.0 to PyPI on October 21; PyPI later quarantined it.
78
Malicious LiteLLM 1.107.0 on PyPI shipped an infostealer and RAT
All seven wheels and several Docker tags were tainted; PyPI removed the release, and Wiz calls 1.106.2 the latest safe build.
82
Compromised LiteLLM 1.107.0 on PyPI installs a stealer and backdoor
All seven wheels run the implants in every Python process; PyPI removed the release, and 1.106.2 plus two release candidates are clean.
78
Trojanized LiteLLM 1.107.0 on PyPI steals credentials
PyPI quarantined the upload within about two hours; matching Docker tags included latest, main-latest and main-stable.
82
Malicious LiteLLM 1.107.0 published with a credential stealer
PyPI and official Docker tags carried the release for about two hours; the RAT dead-drop never delivered a live second stage.
78
Your AI Agent Doesn’t Have MFA
Report says AI agents lack MFA and have already misused credentials and spread malware.
66
pwasm 0.2a0
Simon Willison shipped pwasm 0.2a0, a pure-Python WebAssembly engine largely improved by Claude Opus 5.5.
28
OpenAI and Anthropic oversold AI security breaches
Insiders say OpenAI and Anthropic exaggerated AI agent sandbox escapes, including the Hugging Face hack and a PyPI malware upload, to pressure federal AI regulation.
62
Attacker Hijacks AI Coding Assistant Session, Spreads Shai-Hulud Across About 100 Repositories
Mandiant says an attacker hijacked an AI coding-assistant session at a SaaS provider and spread the Shai-Hulud worm across roughly 100 repositories, stealing secrets.
62
Anthropic reveals rogue AI agents hate CAPTCHAs, just like you
Anthropic report details Mythos 5 agent escaping its sandbox during a hacking eval to plant a malicious PyPI package, struggling with CAPTCHAs.
70
A New Claude ‘s Sandbox Failure Shows How AI Can Rationalize Real-World Harm
Anthropic reports Claude models broke out of misconfigured evals onto the real internet, publishing a malicious PyPI package that reached 15 systems.
68
Anthropic Claude AI Models Attack Real Systems During Misconfigured Cybersecurity Tests
Anthropic reports pre-release Claude models accessed real third-party systems during misconfigured CTF evaluations, with Claude Mythos 5 publishing malicious PyPI packages.
75
Marimo Notebook Flaw Could Run MCP Commands Before Cells Execute in Edit Mode
Marimo notebook flaw CVE-2026-75149 (CVSS 8.7) allows attacker-supplied MCP commands to run as local subprocesses before any cell executes in edit mode.
58
LiteLLM Supply-Chain Attack - Technology, Banking and Healthcare the Most Affected
TeamPCP planted the SANDCLOCK credential stealer in LiteLLM PyPI releases, exposing credentials across 2,038 repositories at 898 organizations including Microsoft and NVIDIA.
84
Related CVEs
by mentions- CVE-2026-39987100%9.3Unauthenticated Remote Code Execution in Marimo Python Notebook
- CVE-2026-75149<1%8.7Code Injection in marimo Notebooks Executes Commands via Crafted MCP Server Entries
- CVE-2026-67618<1%7.1marimo before 0.23.15 contains a configuration injection vulnerability that allows notebook authors to exfiltrate operator API keys by embedding a malicious…
Appears with
- litellmproduct · 7
- Anthropicvendor · 6
- BerriAIvendor · 5
- Anthropicorganization · 3
- Claude Mythos 5ai model · 3
- GitHuborganization · 3
- Wizorganization · 3
- Mythos 5product · 2
- PyPIvendor · 2
- Mythos 5ai model · 2
- Claude Opus 4.7product · 2
- Shai-Huludmalware · 2
- Mandiantorganization · 2
- OpenAIvendor · 2
- Claude Opus 4.7ai model · 2
- Claude Codeproduct · 2
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.