Google says stolen access to cloud AI models ran up charges reaching $1 million at some organisations, and is resold through "LLM Mixers"
Google Threat Intelligence says fraudulent model charges exceeded $100,000 in a single day, with cumulative charges at some organisations reaching $1 million before access was revoked, and that illicit "LLM Mixers" proxy and resell the access, one of them, Jet Night, offering an unlimited token plan for about $60 a month. One actor used a LiteLLM flaw, CVE-2026-40217, to raise standard virtual keys to full proxy-admin credentials.
LiteLLM's postmortem traces the release compromise to a master key it committed to a public repository in May and never revoked
The Register, summarising LiteLLM's own postmortem, reports that the compromise behind the trojanised 1.107.0 release traces to a master key LiteLLM accidentally committed to a public GitHub repository, LiteLLM-Labs/lite-harness, on May 27 — a key belonging to an open-source tool it used internally to orchestrate AI agents — with developers removing the exposed commit but not revoking the key. LiteLLM says that on October 10 "the threat actor used this key to gain access to our LiteLLM Agent Platform" and extracted a GitHub CLI OAuth token, after which "From this point onwards, the threat actor had owner-level access to all repositories in our GitHub." It says the actor committed malicious code to other internal repositories, including CI workflows that could steal tokens and secrets, obtaining OAuth tokens for two engineers with maintainer privileges and tokens for several other internal systems "with a primary focus on upstream inference API tokens". LiteLLM calls the incident a "strong illustration of the risks associated with failing to rotate a potentially exposed key" and says it is revoking every token tied to its internal systems and vendor platforms. Its earlier account had said only that it suspected the GitHub CLI OAuth tokens came from the logs of an internet-exposed internal deployment, and had not confirmed how that deployment was reached.
LiteLLM says attackers used three engineers' GitHub credentials to ship a credential stealer as version 1.107.0
LiteLLM says malicious actions were taken through three engineers' GitHub accounts to force-push and publish version 1.107.0 to PyPI, Docker Hub and GHCR on October 21, and that all tokens involved in the attack have been revoked. Wiz reports the package took about 49,000 downloads per ClickPy data, was uploaded to PyPI at 11:39 UTC and quarantined at 13:20, and that stolen AWS instance role credentials were tested from two addresses about four and a half hours after exfiltration using sts:GetCallerIdentity followed by Bedrock model-listing calls, a pattern Wiz calls consistent with LLMjacking. LiteLLM says it suspects the attacker obtained GitHub CLI OAuth tokens from the logs of an internet-exposed internal deployment, noting that "Claude Code will embed a user's GitHub CLI OAuth token into a response body", and has not confirmed how that deployment was reached.
A cryptomining botnet reads its next command server out of a poem on GitHub, and feeds on exposed LiteLLM and Ollama hosts
Lumen's Black Lotus Labs, publishing October 7, describes PoeLLM as a cryptomining and exploit-scanning campaign that “uses and targets exposed AI/LLM and open-source services,” deploying XMRig and Iron miners into Kryptex mining infrastructure. “The malware derives its current C2 server from keywords in a poem hosted in a GitHub repository”: four words are pulled from the poem and mapped through a hard-coded dictionary into an IPv4 address, so the operator moves the command server by editing the poem — done 11 times as of the research, with the decoding logic untouched. Most victims “appear to run vulnerable versions of open-source AI/LLM services, such as LiteLLM and Ollama”; scanning concentrated on ports 3000 and 4000, corresponding to Gotenberg and LiteLLM, and the LiteLLM command-injection flaw CVE-2026-42271 at the /mcp-rest/test/connection endpoint was “likely the exploitation path.” Hundreds of Gotenberg servers and Gitea instances were also affected, and the malware can turn a victim into a vulnerability scanner, “proxying attacks through compromised hosts.” Black Lotus Labs assesses “that PoeLLM is associated with an Italian-speaking threat actor,” and assesses with moderate confidence that an Italian-hosted administrative server is the operator's management interface. One figure is inconsistent within the report itself: its key takeaways say the malware “has impacted more than 3,400 victim servers” with peak activity “exceeding 800 active servers per day” since at least April 2026, while its body text says “almost 2,200.”
CISA adds an authentication bypass in the LiteLLM AI gateway to its exploited-vulnerabilities catalog
CVE-2026-59822 lets an unauthenticated attacker send a fabricated Authorization header to LiteLLM's MCP Streamable HTTP endpoint, triggering an OAuth2 passthrough fallback that replaces failed key validation with an empty authorisation object and admits requests to MCP tooling. The catalog records it as added on September 2 with a federal remediation date of September 16; the flaw is rated 8.8 under CVSS 4.0 and 8.2 under CVSS 3.1 and is fixed in LiteLLM 1.84.0.
Wiz honeypots record attackers exploiting MCP servers and self-hosted AI stacks
Over a 90-day honeypot study across self-hosted AI services, Wiz Threat Research observed three attack patterns against AI infrastructure: exploitation of Model Context Protocol servers, including an authentication bypass in LiteLLM's MCP gateway that accepted any bearer token and a command-injection flaw used to drop cryptominers; blind indirect prompt injection against LangChain, Flowise, OpenWebUI and Node-RED deployments, confirmed through out-of-band DNS callbacks; and AI-native post-exploitation in which attackers read a compromised LiteLLM process's Python module state in memory to steal master keys rather than searching files.
Microsoft reports attackers compromising self-hosted AI gateways and orchestration platforms for credentials and cryptomining
Microsoft Threat Intelligence describes investigations into intrusions against three self-hosted AI workloads — a LiteLLM gateway, a RAGFlow deployment and a Kestra environment — each reached through vulnerabilities the post names. In the RAGFlow case the attackers injected Python hooks into credential-configuration workflows to intercept newly configured model-provider credentials; across the cases they harvested environment variables and database credentials, established persistence through SSH keys and cron jobs, and deployed the XMRig cryptominer.