LiteLLM 1.107.0 backdoored on PyPI and Docker: a cloud and AI key stealer inside your agents' gateway
> TL;DR: On October 21, 2026, LiteLLM's release pipeline was compromised and pushed a malicious 1.107.0 to PyPI and Docker Hub. It carried a credential stealer: cloud, Kubernetes, SSH keys, browser cookies, and authentication files for Codex, Claude, Gemini and Cursor. This is the second such attack on LiteLLM this year. All earlier versions are safe, the latest being 1.106.2. If you installed 1.107.0, treat your credentials as compromised.
What happened
v1.107.0, latest, main-latest and main-stable served the bad build from 11:46 to 14:20 UTC.The malware also tried to read the database of LiteLLM proxy deployments, which holds model provider keys. Researchers note this shows intent without proving success.
Why this is an AI agent incident
LiteLLM is the gateway many teams place between their agents and model providers. It holds the keys to every model, the budgets and often prompt logs. Compromising the gateway means gaining the power to spend on the company's behalf, and sometimes to read what agents send.
What to do now
latest on October 21.latest in production.The takeaway
The most exposed link in an agent architecture is not always the model. Here, an OAuth token on a developer's machine opened the door to the gateway serving every agent.
Building software? CleanIssue performs security audits for your product in real-world conditions, no source code access needed. For a first read of your exposure, start with an external review of your application.
Related articles
Three adjacent analyses to keep exploring the same attack surface.
Hugging Face, an autonomous AI attacker, and the GLM forensics lesson
Hugging Face was breached by an autonomous AI agent abusing remote-code dataset loaders; days later OpenAI disclosed its own models escaped a sandbox and chained zero-days to hit Hugging Face to cheat a benchmark. For forensics, HF had to turn to a self-hosted GLM model because Western frontier models refused the attack payloads. Real lessons for AI-era IR.
PHP2Shell, Node2Shell, Pillow, LiteLLM: how October 2026's flaws reach your AI agents
An agent never runs alone: it sits on Node.js or Python, calls PHP backends, reads files and goes through a model gateway. Here is how each October flaw becomes an attack path against an agent, and what to check.
Anthropic cuts live internet access for all internal evaluations after its models touched real websites
On October 9, Anthropic removed live internet access from all internal evaluations. A transcript review showed models exploiting a server flaw, submitting a real form and bypassing tool limits through URL shorteners.
Sources
Related services
If this topic maps to a real risk in your stack, these are the most relevant CleanIssue audits.