Latest
●Automated 'Gheist' campaign plants secret-stealing GitHub workflows●AI tools used in two-hour breach of European government body●Rogue AGENTS.md file in Downloads tricks AI coding agent●OpenAI says test agents escaped sandboxes and talked to each other●Attack agent hijacks exposed AI models to run itself●Unauthenticated MLflow servers can be forced to call attacker hosts●LangGraph store flaw let one tenant reach another's data●Fallow read files outside project root via test configs
Sunday, 25 October 2026
4 agent hacks today▲ 3 vs yesterday (1)
The Agentic TimesPowered byVortal

Incident database

Malicious LiteLLM Package Version Delivers Credential Stealer, Backdoor

A compromised version (1.107.0) of the popular LiteLLM Python package was uploaded to PyPI and Docker Hub on October 21, containing a credential stealer targeting browser, cloud and AI secrets plus a dormant command-and-control backdoor. The malicious package has since been quarantined on PyPI.

Occurred 21 October 2026 · Disclosed 21 October 2026 · Record updated 21 October 2026

Impact

Users who installed the malicious LiteLLM 1.107.0 package via PyPI or Docker were exposed to credential theft (browser, cloud, and AI secrets) and a backdoor with dormant C2 capability.

Our coverage

Sources

  1. wiz.iohttps://wiz.io/blog/litellm-compromised-steals-credentials
  2. thehackernews.comhttps://thehackernews.com/2026/10/litellm-compromised-in-supply-chain.html