AI Supply Chain Breach: 2,500 Companies at Risk

It takes just forty minutes online on a public repository to turn a software library into a global Trojan horse. This is revealed by CloudSEK's investigation into the largest AI supply chain breach ever recorded, an attack that, according to the report, has potentially exposed over 2,500 companies and 434,000 CI/CD pipelines worldwide. The strike, orchestrated in March 2026 by the threat actor group known as Team PCP, targeted LiteLLM, a widely used tool for managing the infrastructure of language models, leaving behind a trail of stolen credentials that remain an active threat months later.

Summary

• Key Points
• The largest AI supply chain breach of 2026 involves over 2,500 companies
  • Scope and extent of exposure
  • Notable organizations involved
• Attack methods and data theft
  • Compromise via LiteLLM PyPI package versions 1.82.7 and 1.82.8
  • Initial compromise through Trivy in the LiteLLM CI pipeline
  • Types of stolen credentials and their implications
• Ongoing risks and security recommendations
  • FBI FLASH alert and risks of malicious use
  • Credential rotation and prioritization in investigations
  • Importance of monitoring AI infrastructure with CloudSEK AIvigil
• FAQ
  • How many companies were potentially exposed in the AI supply chain breach related to LiteLLM?
  • What types of credentials were stolen during the attack?
  • How did the attackers compromise the LiteLLM packages?
  • What are the recommended steps for organizations affected by the breach?

Key Points

• Over 2,500 companies and 434,000 CI/CD pipelines are potentially exposed according to the dataset reconstructed by CloudSEK.
• The attack passed through versions 1.82.7 and 1.82.8 of the LiteLLM PyPI packages, which remained online for about 40 minutes.
• Among the stolen data are cloud keys, repository tokens, SSH keys, Kubernetes secrets, and AI provider keys.
• The FBI has issued a FLASH alert (FLASH-20260702-01) regarding the risk that the stolen credentials are still being exploited.
• Among the organizations with high-confidence matches are NVIDIA, AWS, Cisco, Salesforce, Siemens, X Corp, and Orange S.A.

The largest AI supply chain breach of 2026 involves over 2,500 companies

The number speaks for itself regarding the severity of the incident: more than 2,500 companies appear in the exposure dataset reconstructed by CloudSEK, along with 434,000 potentially compromised CI/CD pipelines. This is not a theoretical estimate, but a snapshot of a software development ecosystem that, for weeks, continued to download and use poisoned packages unknowingly.

Scope and extent of exposure

CloudSEK explicitly refers to potential exposure, not confirmed compromise for every single organization. This is an important distinction: a company listed in the dataset as "high confidence" must initiate private checks, internal notifications, and log monitoring, but being on the list does not automatically equate to a successful breach. That said, the scale remains unprecedented for an attack centered on AI infrastructure.

Notable organizations involved

Among the names with high-confidence matches in the dataset are giants such as NVIDIA, Amazon Web Services, Cisco Systems, Salesforce, Siemens, X Corp (Twitter), and Orange S.A.. The variety of sectors involved, from cloud to telecommunications, from manufacturing to finance, shows how pervasive the reliance on open-source tools like LiteLLM is in modern development pipelines.

Attack Methods and Data Theft

The attack did not directly target LiteLLM but went through a security tool that LiteLLM itself trusted: the Trivy scanner. Understanding this detail is crucial to comprehend why the incident was defined as a supply chain attack rather than a simple software bug.

Compromise via LiteLLM PyPI Packages Versions 1.82.7 and 1.82.8

The malicious versions 1.82.7 and 1.82.8 were published on PyPI during a very brief exposure window, just 40 minutes according to CloudSEK's reconstruction. A minimal time, but sufficient for automated build systems, which install dependencies at machine speed, to download and propagate the poisoned code on a massive scale. Inside the packages was a .pth file that executes upon starting the Python interpreter; it does not even require explicitly importing LiteLLM: installation alone activates the payload, thus bypassing common security protections.

Initial Compromise via Trivy in LiteLLM's CI Pipeline

At the root of it all is a compromised automation token, rotated but not fully revoked, which left a window of about 20 days during which the attacker could force malicious updates on the published version tags of the Trivy scanner. LiteLLM's CI pipeline installed Trivy without pinning its version via the apt package manager, so the compromised scanner flowed automatically into the build, which in turn produced and published the poisoned releases 1.82.7 and 1.82.8. One unrevoked token, three tools away: this is the mechanism that turned an isolated vulnerability into an ecosystem-wide exposure.

Types of Stolen Credentials and Their Implications

The list of stolen data is broad and concerning: cloud keys, repository tokens, SSH keys, Kubernetes secrets, package publishing credentials, environment variables, and AI provider keys. On the compromised CI runners, the stealer from the Team PCP group gained root privileges and systematically collected AWS, GCP, and Azure credentials, Kubernetes tokens, and .env files, including information that GitHub Actions typically tries to mask. For AI-oriented builds, the haul also included API keys for language models and gateway configurations, meaning access keys to an organization’s entire AI stack.

This is where the breach stops being an isolated technical issue and becomes a systemic risk: the stolen credentials allow access to cloud accounts, source control systems, SaaS platforms, and AI providers, paving the way for lateral movements within corporate infrastructures far beyond the originally affected package.

Ongoing Risks and Security Recommendations

The removal of the malicious package from PyPI does not close the incident. Copied credentials remain usable for weeks or months if they are not rotated and if subsequent activity is not thoroughly investigated.

FBI FLASH Alert and Risks of Malicious Use {#FBI_FLASH_Alert_and_Risks_of_Malicious_Use}

Confirming that the threat remains active is the FBI's FLASH alert from July 2026 (FLASH-20260702-01), which warns that actors linked to the campaign are likely to exploit the collected credentials even long after the original intrusion. This means that new supply chain attacks remain a real possibility, not an archived risk.

Credential Rotation and Investigation Priorities {#Credential_Rotation_and_Investigation_Priorities}

Simply rotating the LiteLLM key or the model provider's key is not enough. Any credential readable by the affected process, present in memory, injected into the job, saved on disk, or retrievable via the instance's metadata service must be considered potentially exposed until validated. It is an uncomfortable but necessary principle: the lack of obvious signals of malicious activity is not proof that a credential has not been copied, and for accesses impacting production, the cost of preventive rotation is almost always lower than the cost of late containment.

Importance of Monitoring AI Infrastructure with CloudSEK AIvigil {#Importance_of_Monitoring_AI_Infrastructure_with_CloudSEK_AIvigil}

To address this type of scenario, CloudSEK has developed AIvigil, a monitoring platform for the AI attack surface designed to continuously discover, monitor, and protect exposed AI infrastructures, MCP servers, stolen AI credentials, vector databases, agent workflows, and so-called shadow AI, which are AI applications not listed in the official inventory of companies. The system combines cyber threat intelligence with AI exposure monitoring to link an external signal to the asset, the credential, the software dependency, and the business system that is truly at risk.

The LiteLLM incident signals something that goes beyond a single incident: AI infrastructure is becoming a high-value strategic target for those conducting supply chain attacks. Gateways, autonomous agents, vector databases, and MCP servers are becoming the hubs of modern digital operations, much like railway stations became strategic targets when many trade routes converged at a single point. Compromising a single AI checkpoint, as this case demonstrates, can expose identities and systems much broader than the name of the affected package might suggest.

FAQ {#FAQ}

How many companies were potentially exposed in the AI chain breach related to LiteLLM? {#How_many_companies_were_potentially_exposed_in_the_AI_chain_breach_related_to_LiteLLM}

According to the exposure dataset reconstructed by CloudSEK, over 2,500 companies are potentially involved.

What types of credentials were stolen during the attack? {#What_types_of_credentials_were_stolen_during_the_attack}

The stolen credentials include cloud keys, repository tokens, SSH keys, Kubernetes secrets, package publishing credentials, environment variables, and AI provider keys.

How did the attackers compromise the LiteLLM packages? {#How_did_the_attackers_compromise_the_LiteLLM_packages}

The attackers took control of the Trivy security scanner used in the LiteLLM CI pipeline and injected malicious code into versions 1.82.7 and 1.82.8 of the LiteLLM PyPI packages.

What are the recommended steps for organizations affected by breaches? {#What_are_the_recommended_steps_for_organizations_affected_by_breaches}

Organizations involved should extensively rotate all exposed credentials, isolate affected systems, rebuild environments from clean sources, monitor the runtime behavior of CI/CD pipelines, and continuously surveil their AI infrastructure.

Content created with the assistance of artificial intelligence and human editorial review.

This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.