Security researchers have identified what they’re calling the largest AI supply chain breach uncovered so far in 2026, and the numbers behind it are staggering. According to threat intelligence firm CloudSEK, a compromise tied to the widely used LiteLLM project may have touched more than 2,500 companies and roughly 434,000 CI/CD pipelines worldwide. The scale alone makes this one of the more consequential software supply chain incidents to hit the AI ecosystem, and the fallout is still being sorted out months later.
Summary
Key takeaways
- CloudSEK’s reconstructed exposure dataset lists over 2,500 companies and 434,000 CI/CD pipelines as potentially exposed in the breach.
- The threat actor group known as Team PCP orchestrated the attack in March 2026 by compromising LiteLLM PyPI packages versions 1.82.7 and 1.82.8.
- The initial entry point was the Trivy security scanner used inside LiteLLM’s build pipeline, which stayed compromised for roughly 20 days.
- Stolen data reportedly includes cloud keys, repository tokens, SSH keys, Kubernetes secrets, package publishing credentials, environment variables, and AI provider keys.
- The FBI issued a FLASH advisory in July 2026 warning that stolen credentials could still be weaponized for future attacks.
Largest AI Supply Chain Breach of 2026 Exposes Over 2,500 Companies
CloudSEK’s investigation points to a breach large enough to reach into the software pipelines of thousands of organizations, many of which had no direct relationship with the compromised project beyond using it as a dependency. That’s the nature of modern software supply chains: one poisoned package can ripple outward through countless unrelated companies.
Notable Organizations Named in the Exposure Dataset
Among the organizations CloudSEK flagged as high-confidence matches in its exposure dataset are NVIDIA, Amazon Web Services (AWS), Cisco Systems, Salesforce, Siemens AG, X Corp (Twitter), and Orange S.A., along with dozens of other global enterprises spanning finance, telecommunications, manufacturing, and defense. CloudSEK is careful to note that a “high confidence” match reflects the strength of the exposure evidence, not confirmed proof that an organization was actually compromised or that data was stolen and used. Still, being named in a dataset like this is enough to trigger urgent internal review, and several of the named organizations operate infrastructure that underpins large portions of the internet and enterprise cloud computing.
This matters because a breach of this size doesn’t just affect one company’s product line — it potentially touches the credentials and pipelines connecting cloud accounts, source-control systems, SaaS platforms, and AI providers used across entire industries.
How the Attack Unfolded: From Trivy to LiteLLM
The breach began not with LiteLLM itself but with a trusted tool sitting inside its build process. Attackers took over the Trivy security scanner that LiteLLM’s CI pipeline relied on, using a leaked automation token that had been rotated but never fully revoked. That gap left an approximate 20-day window during which the attackers could force-push malicious code over Trivy’s published version tags — code that still looked legitimate to anyone downstream.
From there, the poisoned scanner flowed automatically into LiteLLM’s own build system, which then produced and published two compromised releases to the Python Package Index: versions 1.82.7 and 1.82.8. Those packages were live on PyPI for roughly 40 minutes, according to CloudSEK — a narrow window that nonetheless was enough to seed a global exposure event, since automated pipelines install dependencies at machine speed and often run with broad system privileges.
The malicious code executed through a `.pth` file that runs automatically when Python starts, meaning no explicit import of LiteLLM was even required to trigger it. That detail let the payload sidestep common install-time protections security teams rely on.
What the Attackers Stole
Once running, the malware escalated privileges and swept up a wide range of sensitive material from affected systems. Reported categories of exfiltrated data include:
- Cloud credentials for AWS, GCP, and Azure, along with Kubernetes tokens and service-account paths.
- Repository tokens, SSH keys, and package-publishing credentials for source-control and registry platforms.
- Environment variables and `.env` files containing application secrets.
- AI provider keys and gateway configuration data tied to organizations’ broader AI stacks.
According to CloudSEK, the stolen data was encrypted and, in some cases, shipped to a typosquatted domain; where exfiltration failed, the malware reportedly created a public repository inside the victim’s own GitHub account and uploaded the stolen data there as a release asset — meaning some organizations may have been leaking their own secrets into public view without realizing it. Because these credentials can reach cloud accounts, repositories, SaaS platforms, and AI provider systems, the practical consequence of this AI supply chain breach extends far beyond the LiteLLM package itself.
Ongoing Risks and What Comes Next
The threat here didn’t end when the malicious packages were pulled from PyPI. Stolen credentials remain usable for weeks or months unless they’re actively rotated, and that’s precisely why federal authorities weighed in.
FBI Warning and Credential Rotation
The FBI issued a FLASH advisory in July 2026 (FLASH-20260702-01) warning that actors linked to this campaign are likely to weaponize the harvested credentials long after the original intrusion — a signal that further supply chain attacks stemming from this breach remain a real possibility. This is one reason CloudSEK stresses that rotating only the LiteLLM key or a single model-provider credential isn’t enough. Any credential readable by the affected process — whether stored on disk, present in memory, injected into a job, or retrievable through an instance metadata service — should be treated as potentially exposed until it’s verified otherwise.
That broad rotation requirement is a heavier lift than it sounds. In practice, it means security teams need to inventory every credential a compromised pipeline could have touched, not just the obvious ones tied to the poisoned package.
CloudSEK AIvigil and AI Infrastructure Monitoring
CloudSEK frames this incident as evidence that AI infrastructure — gateways, agent runtimes, vector databases, and MCP servers — is becoming a strategic high-value target precisely because it sits at the junction of data, identity, and automated action across an organization. Its AIvigil platform is built around that premise, continuously monitoring AI infrastructure to detect exposed credentials, unmanaged shadow AI assets, and risky agentic workflows before they turn into full-blown attack paths.
The broader lesson researchers are drawing from this episode is that compromising a single AI-adjacent tool — in this case a security scanner three steps removed from the final target — can expose an entire web of connected identities and systems. As AI components get embedded deeper into everyday development and business workflows, the blast radius of a single upstream compromise only grows.
FAQ
How many companies were potentially exposed in the LiteLLM AI supply chain breach?
Over 2,500 companies were potentially exposed, according to CloudSEK’s reconstructed exposure dataset.
What types of credentials were stolen in the breach?
Stolen credentials reportedly included cloud keys, repository tokens, SSH keys, Kubernetes secrets, package publishing credentials, environment variables, and AI provider keys.
How did the attackers compromise the LiteLLM packages?
Attackers compromised the trusted Trivy security scanner used in LiteLLM’s CI pipeline and inserted malicious code into LiteLLM PyPI packages versions 1.82.7 and 1.82.8.
What are the recommended steps for organizations affected by this breach?
Affected organizations are advised to rotate all exposed credentials broadly, isolate affected systems, rebuild environments from clean sources, monitor CI/CD runtime behavior, and continuously monitor their AI infrastructure going forward.
Article produced with the assistance of artificial intelligence and reviewed by the editorial team.
