On August 11, 2026, the security company CloudSEK published an analysis describing the largest AI-related software supply chain compromise (the entire set of external components a piece of software uses without having written them itself) to occur in 2026. The target is called LiteLLM, a widely used component that lets applications communicate with AI models. The attack itself dates back to March 2026.
The most striking detail in this case comes down to a single number: the trapped versions of LiteLLM stayed available for download for about forty minutes. The toll, though, is counted in thousands of organizations and hundreds of thousands of automated systems affected, months later. This imbalance between the length of the exposure and the scale of the damage is at the heart of what the report reveals.
Forty minutes, and it was done
The attack is attributed to a group known as Team PCP. Its method doesn’t target LiteLLM directly. It takes a detour: Trivy, a security scanner (a tool meant to spot flaws in code, hijacked here) used inside LiteLLM’s own build pipeline, meaning the process that turns source code into software ready for distribution. By compromising Trivy, the attackers position themselves upstream, exactly where no one expects them.
This hijacked scanner stays in place for about 20 days without being noticed. It eventually produces two trapped versions of LiteLLM, numbered 1.82.7 and 1.82.8, published on PyPI, the public registry where Python developers fetch this kind of component. This is where the window closes fast. These two versions stay online for only about forty minutes before being pulled.
| Step | Detail |
|---|---|
| March 2026 | Team PCP compromises Trivy, the security scanner built into LiteLLM’s build pipeline |
| About 20 days | The scanner remains compromised without being detected by the LiteLLM team |
| March 2026 | Two trapped versions, 1.82.7 and 1.82.8, are published on PyPI |
| About 40 minutes | Length of time the trapped versions stay available for download |
| August 11, 2026 | CloudSEK publishes its full analysis of the incident |
A forty-minute window seems laughably small next to a toll counted in thousands of companies. It’s exactly this disproportion that makes the incident stand out for the researchers who documented it.
Why so little time was enough
Forty minutes is enough because, in this scenario, nobody needs to click on anything. LiteLLM isn’t installed by hand by users who would read every update. It’s fetched automatically by continuous integration pipelines, also called CI/CD (the system that builds and deploys a piece of software on every change, without human involvement). As soon as a trapped version is published on PyPI, these pipelines can pull it and integrate it before any human has time to notice.
CloudSEK estimates that about 434,000 CI/CD pipelines were potentially exposed by this mechanism. That figure gives the true measure of the problem: it isn’t the flaw itself that weighs heaviest, it’s the speed at which an automated component spreads across thousands of different environments before anyone understands what happened.
The other notable element is the entry point chosen. Trivy is itself a security tool, designed to protect code against this kind of intrusion. Hijacking it to infiltrate a build pipeline amounts to turning the defensive tool against the very target it was meant to protect.
Who is affected, and why it isn’t over
The dataset compiled by CloudSEK lists more than 2,500 potentially exposed companies. Among the matches considered the most reliable are NVIDIA, Amazon Web Services, Cisco Systems, Salesforce, Siemens AG, X Corp and Orange S.A. The full list runs to dozens of other organizations, spread across finance, telecommunications, industry, and defense.
The report insists on a point that goes beyond the simple observation of exposure. What the trapped versions of LiteLLM could collect were credentials (the keys and passwords that grant access to services), at the exact moment CI/CD pipelines were building and deploying their software. Pulling a trapped version from PyPI stops the problem from spreading further, but it doesn’t invalidate the credentials already stolen while it was circulating.
The FBI published a FLASH alert in July 2026 about this specific case. In it, the agency warns that credentials stolen during this compromise can still be used to mount future attacks, months after the initial incident. It’s this alert, more than the flaw itself, that explains why the topic is still current in August 2026, even though the two trapped versions existed for only forty minutes.
This kind of incident is part of a broader series of flaws affecting the tools surrounding artificial intelligence. We already covered another AI-related security case in our article about the security flaws surrounding GPT-5.6, where the common thread stays the same: the speed at which an automated component can spread, well before human vigilance has time to step in.
0 Commentaires
Aucun commentaire pour le moment. Soyez le premier à commenter !