LiteLLM 1.107.0 Shipped Malware: What to Do With AI Keys

LiteLLM, an open-source gateway that many applications use to reach OpenAI, Anthropic and other AI providers, shipped version 1.107.0 on October 21, 2026 with malicious code that steals credentials. Anyone who installed it, or started its Docker image, between 11:39 and 14:20 UTC that day should treat their keys as exposed.

What we know

  • The package: according to LiteLLM's incident report, litellm 1.107.0 was live on PyPI on October 21 from 11:39 to 13:23 UTC. It has been removed.
  • The Docker images: LiteLLM says the v1.107.0, latest, main-latest and main-stable tags pointed to the compromised image on Docker Hub from 11:46 to 14:20 UTC, and on GHCR until 13:51 UTC. Anyone who pulled "latest" in that window got the bad build without asking for 1.107.0.
  • What is not affected: the company says all previous versions are safe, the v1.107.0 source tag on GitHub does not contain the malicious files, and the private registry for its enterprise release was not affected.
  • How it happened: LiteLLM says the GitHub accounts of three engineers were used, "appear[ing] to be" through stolen GitHub CLI OAuth tokens, to change the release workflow and build from an attacker-controlled repository. It does not yet know how the tokens were obtained.
  • What the malware does: according to the analysis posted on GitHub by Upwind's team and to Aikido Security, it runs every time Python starts in that environment, collects cloud keys, SSH keys, browser-saved passwords, environment variables and the AI provider keys stored in LiteLLM's database, and sends them to an attacker domain. It also leaves a component that can download and run more code.
  • Use of stolen data: Wiz says it saw stolen AWS credentials validated about 4.5 hours after exfiltration, followed by checks on Bedrock model access, a pattern it links to running AI models at the victim's expense.
  • Status: LiteLLM describes the incident as contained, with the investigation ongoing. It says it revoked the tokens involved, cut maintainer permissions and pulled the packages from PyPI, Docker Hub and GHCR.

What changes and what doesn't

Nothing changes if you pin an earlier version, such as 1.106.2, or did not install or update LiteLLM in that window. Nothing changes either if you use ChatGPT, Claude or Gemini directly: the problem is in a component installed on servers and apps, not at the providers.

It does change if you install without a pinned version or run the latest Docker tag and updated during those hours. LiteLLM says to assume exfiltration succeeded if 1.107.0 was ever installed on a machine with outbound internet access. Because LiteLLM usually stores keys for several providers in one place, a single affected install can expose all of them at once.

How to tell if you're affected

  1. Find out whether your site or AI tool uses LiteLLM. If a developer or vendor built your chatbot, internal search or agent, ask three things: do you use LiteLLM, which version, and was it installed or updated on October 21 between 11:39 and 14:20 UTC?
  2. Check the installed version. On the server or container, `pip show litellm` shows it. LiteLLM says seeing 1.107.0, or the files `cook.pth` or `sitecustomize.py` among the Python packages, confirms exposure. Not finding them does not prove the environment is clean.
  3. Don't fix it by installing on top. Per LiteLLM's guidance, any Python start in that environment re-runs the malicious code. It recommends rebuilding the environment or image from scratch with `litellm==1.106.2`.
  4. Revoke keys in each provider's dashboard. That means the AI keys stored in LiteLLM, LiteLLM's own master and virtual keys, its database password, the server's cloud credentials and any secret in environment variables. Changing a key only in the config does not kill the old one: delete it where it was issued and create a new one.
  5. Check usage since October 21 in each AI provider's dashboard and in your cloud console. Off-hours spikes or models you don't use are the usual sign of someone else spending on your account.
  6. Pin versions from now on. According to LiteLLM, the people exposed were those who installed without a fixed version or with tags that always point to the newest build. A pinned version that you update on purpose keeps you out of this kind of incident.

Related: OpenCode Breach Put AI API Keys at Risk: What to Do

Sources

Updates: if LiteLLM explains how the tokens were stolen or widens the list of affected artifacts, it will be added here with a link.