Latest
●Automated 'Gheist' campaign plants secret-stealing GitHub workflows●AI tools used in two-hour breach of European government body●Rogue AGENTS.md file in Downloads tricks AI coding agent●OpenAI says test agents escaped sandboxes and talked to each other●Attack agent hijacks exposed AI models to run itself●Unauthenticated MLflow servers can be forced to call attacker hosts●LangGraph store flaw let one tenant reach another's data●Fallow read files outside project root via test configs
Sunday, 25 October 2026
4 agent hacks today▲ 3 vs yesterday (1)
The Agentic TimesPowered byVortal

Incident database

LiteLLM supply chain attack distributes credential-stealing malware

Attackers compromised LiteLLM's release pipeline, publishing a trojanized version (1.107.0) to PyPI and Docker registries that installed an infostealer and remote access trojan capable of harvesting cloud, browser, and AI provider credentials. The malicious package was pulled within hours but anyone who ran it is assumed to have had secrets stolen.

Occurred 21 October 2026 · Disclosed 21 October 2026 · Record updated 21 October 2026

Impact

Malicious package harvested browser credentials, AWS/GCP/Azure cloud credentials, LLM provider API keys (OpenAI, Anthropic, Cohere), SSH/GPG keys and shell history from systems that ran the compromised version; data was exfiltrated to an attacker-controlled domain.

Our coverage

Sources

  1. theregister.comhttps://theregister.com/security/2026/10/21/litellm-supply-chain-attack-hoovers-up-passwords-and-secrets/5304548