There is a valve in the AI stack that most teams never think about, and this week it leaked. LiteLLM — an open-source gateway that lets thousands of companies route prompts and API keys to any model from one place — shipped a poisoned update that exposed credentials from an estimated 2,500 organizations and 434,000 CI/CD pipeline runs. The smallest part of the machine turned out to be the most trusted, and the most trusted turned out to be the best way in.
LiteLLM’s job is unglamorous and ubiquitous. It sits between a developer’s code and the dozens of model providers — OpenAI, Anthropic, Google, a hundred open-weight labs — and it handles the routing, the billing, and, critically, the keys. A team that standardizes on LiteLLM stores its cloud credentials, its LLM API keys, its Kubernetes tokens, all in one place, because the gateway needs them to talk to everything downstream. That convenience is the product. It is also the blast radius.
CloudSEK’s analysis of the attack found poisoned LiteLLM packages on PyPI, the Python package index that nearly the entire AI ecosystem downloads from. Organizations that pulled the malicious release into their build pipelines unwittingly shipped the backdoor into their deployment chain. Once inside a CI runner, the malware harvested the secrets the runner had been granted — because of course the runner had been granted secrets; that is how CI works.
The Supply Chain’s Soft Belly
This is not a story about one company’s misconfiguration. It is a story about the layer of the AI stack that no one was watching. The model labs harden their APIs and their fine-tunes; the biggest clouds pour money into perimeter defense. But the gateway that sits between them — the piece of open-source plumbing a startup installs in an afternoon and then never inspects again — turns out to be exactly where the trust is concentrated. A single malicious release there becomes a master key to everything it touches.
CloudSEK is careful to call the figure “exposure, not confirmed breach” — the poisoned releases reached organizations through normal dependency resolution, and not every exposure became a foothold. But the security industry’s own analysis lands on the same word: supply. This is a supply-chain attack, the AI-native kind, and it moves the way modern attacks move: quietly, through the plumbing everyone assumes is safe.
What makes it an AI-infrastructure event, not just another software supply-chain incident, is where the secrets went. LiteLLM gateways hold API keys for the frontier model vendors, the tokens that let a company call GPT-class systems at scale. The attacker who steals those keys is not stealing an artifact; they are stealing inference capacity — the ability to run other people’s models on other people’s accounts. In the AI economy, credentials are compute, and compute is money.
The Gateway Is Now the Target
For years the AI security narrative was about the models themselves: jailbreak prompts, data exfiltration through chat, the rogue agent that reaches the production network. All real, all worth covering. But the LiteLLM incident points at a different seam — the integration layer, the connective tissue between the code, the keys, and the model providers. It is the layer distinct from the ones the industry has spent billions hardening, and it is the layer where most real AI systems are actually assembled.
The model is the product; the gateway is the trust. No one was watching the gateway.— The AI stack’s quietest layer
The fix is unglamorous, the way every fix in this story is. Teams that pull machine learning tooling from package registries need to treat it the same way they treat any privileged dependency: pin versions, inspect diffs, rotate the secrets that gateways touch. The tools that make the AI stack convenient — gateways, package managers, CI runners — are the tools that make it weak when they are not loved. The poison goes where the trust is.
The deeper message is about the industry’s reflex to look up instead of down. The labs demos the frontier. The security conferences chase the zero-days. But the supply chain that actually delivers model inference — a pip install, a gateway config, a CI runner with secrets — is where the next several years of AI incidents will arrive. The valve in the pipe was always the place the water leaves the system.
What This Means
- The integration layer is the new frontier. Gateways, package managers, and CI runners are where the AI economy actually concentrates trust — and where the attackers now fish.
- Exposure is the new breach. CloudSEK counts it as exposure; the industry calls it the largest AI supply-chain breach of 2026. The gap between those words is where the damage lives.
- Rotate the keys. The fix for most teams is not a new firewall. It is treating every gateway credential as if a stranger has touched it — and rotating before they use it.
The AI economy runs on trust in plumbing. This week, the plumbing leaked — and the secret was in the pipe all along.