LiteLLM's root-cause report: a master key leaked in May and never revoked led to the poisoned 1.107.0
LiteLLM's October 23 investigation traces the malicious litellm 1.107.0 release to an agent-platform master key committed to a public repo on May 27 and never rotated. It let an attacker pull a GitHub org owner's token on October 10 and ship a signed release on October 21.
Here's the chain, per LiteLLM's write-up. The leaked key opened the LiteLLM Agent Platform, an internal tool that let self-hosted agents file PRs. Its API returned every managed agent's config, and one config held a GitHub CLI OAuth token belonging to an organization owner (a person's login, not a scoped service account). LiteLLM points out that GitHub CLI tokens skip GitHub's 2FA re-prompt on sensitive org actions.
With that token, the attacker pushed throwaway branches whose CI workflows posted repository secrets to a webhook.site endpoint. That gave them the tokens of two more maintainers. On October 21 they overrode branch protection, pointed the release workflow at a lookalike repo (Berri-AI/litellm instead of BerriAI/litellm), and used the second maintainer's token to approve the production gate. That gate had been loosened earlier the same week so any two engineers could ship bugfix backports.
The PyPI wheels were live from 11:39 to 13:23 UTC on October 21. Docker Hub tags v1.107.0, latest, main-latest and main-stable pointed at the bad image until 14:20 UTC. A community member, LidorMachluf, flagged it in issue #47826 at 12:06 UTC.
LiteLLM says it is revoking every token on every internal system and will share process changes next week. Separately, its enterprise registry carries an embargoed fix for a vulnerability due to be disclosed October 27.
Why it matters for builders
If you run an agent that opens PRs, its config probably holds a GitHub token. This attack went through exactly that: an agent platform whose API handed back a full-power owner token. Any key that sat in a public commit, even for a few minutes, needs rotating. A force-push doesn't take it back.
Try this
Run pip show litellm in each environment and search site-packages for cook.pth and sitecustomize.py. If you ran 1.107.0 or one of those Docker tags in the window, LiteLLM says to delete those files from the shell before starting Python, rebuild from an earlier pinned version (the post names 1.106.2), and rotate every key the host could reach. Then run gh auth status on any machine an agent uses.
Sources
Get stories like this every Monday
One tested AI workflow with the prompts, plus 3 news items that matter if you build. Free.
More AI news
- Hugging Face releases Carbon-X, a 14.8B open model that reads DNA and answers in English
- Nanbeige4.3-33B: an open 33B model whose card claims it beats Qwen3.8-27B on most agent coding tests
- Ollama adds text-to-speech: Phonon runs locally on Macs behind an OpenAI-style speech endpoint
- Anthropic's advice for agent builders: fold most subagents back into one loop with skills