153GB of Cloud Credentials Stolen In the Largest AI Supply Chain Attack of 2026

A supply chain attack targeting LiteLLM, one of the most widely used AI gateway and orchestration libraries in the world, exposed more than 2,500 companies and approximately 434,000 CI/CD pipelines. The malicious packages survived on PyPI for only 40 minutes. CloudSEK and Hudson Rock both published independent analyses this week. They confirmed the attack as the largest AI infrastructure breach of 2026. The FBI issued a FLASH advisory warning that attackers can still weaponize the stolen credentials months later.

The threat actor group TeamPCP orchestrated the attack in March 2026 by exploiting a chain of trust failures that started with a single overlooked credential. They first compromised the Trivy security scanner inside LiteLLM’s build pipeline. They used an automation token that someone had rotated but never fully revoked. That gap gave them a 20-day window to force-push malicious code over Trivy’s version tags. Everything still looked legitimate to downstream systems. The poisoned scanner then flowed into LiteLLM’s build system automatically. That system produced and published two compromised releases to PyPI: versions 1.82.7 and 1.82.8.

The malware harvested credentials with surgical efficiency once it reached victim environments across the global software development ecosystem. Version 1.82.8 contained a .pth startup file that ran whenever Python initialized. Developers never needed to import LiteLLM explicitly for the payload to execute. The malware grabbed environment variables and local credential files.

It targeted .aws/credentials and .kube/config specifically, and attempted lateral movement within Kubernetes clusters. It also installed persistence through a systemd service. The stolen data covered AWS secrets, GitLab identities, and Salesforce credentials. Attackers also captured Slack tokens, Azure secrets, SSH keys, and AI provider API keys.

Hudson Rock obtained and analyzed a 153GB RAR archive containing exactly 433,909 files from the breach, attributing 118,829 CI runner dumps to 2,488 corporate domains. The analysis traced environment dumps to Boeing, Orange, and Roku. Exposed GITLAB_USER_EMAIL variables directly linked pipeline data to enterprise identities. These attributions gave researchers their first clear view of who the attack actually hit.

The exfiltration method matched the sophistication of the initial compromise by using multiple fallback channels to guarantee data delivery. The malware encrypted stolen data and shipped it to a typosquatted domain. Where that path failed, it created a public repository inside the victim’s own GitHub account. It then uploaded the stolen data as a release asset. Some organizations were actively leaking their own secrets into public view without realizing it.

Click here to see the complete list of the companies affected. The researchers had high confidence that these organizations had their credentials exposed:

• Roku, Inc.
• Nvidia Corporation
• Amazon Web Services (AWS)
• Samsung Electronics
• samsung.com
• Salesforce, Inc.
• Cisco Systems, Inc.
• F. Hoffmann-La Roche AG
• ServiceNow
• Siemens AG
• S&P Global
• Airbus US Space & Defense
• John Deere
• Regeneron Pharmaceuticals, Inc.
• London Stock Exchange Group (LSEG)
• Thomson Reuters
• FedEx
• Munich Remunichre.com
• MediaTek Inc.
• Volkswagen AG
• Deloitte
• The Kroger Co.
• Siemens Energy
• Thales Group
• X Corp (Twitter)
• Zscaler, Inc.
• Epic Games
• Orange S.A.
• HP Inc.
• Philips
• Fortum Oyj
• Vodafone Group Plc
• Carl Zeiss AG
• Deutsche Bahn AG
• NGINX, Inc.
• BT Group
• Liebherr
• Krungthai Bank Public Company Limited

The FBI’s July 2026 FLASH advisory (FLASH-20260702-01) warns that affiliated actors will likely weaponize harvested credentials long after the original intrusion window closed. Further downstream supply chain attacks remain a real possibility five months after the initial compromise. Many affected organizations still have not rotated their credentials. They lack clear attribution linking their secrets to the breach, so they do not know they need to act.

LiteLLM occupies a specific chokepoint in modern AI infrastructure, operating as the gateway layer connecting applications to AI provider keys and autonomous agents. Compromised credentials from an AI runtime environment can reach customer-facing systems directly. Attackers could intercept, redirect, or manipulate AI service calls. Security researchers identified exposed LLM API keys and gateway configurations. That exposure means attackers can potentially control how compromised organizations interact with their own AI workloads.