A 40-Minute Attack Exposed Credentials from Microsoft, Amazon, Cisco and 2,500 Other Organisations
A tampered version of a widely used AI development tool quietly stole access keys from thousands of companies before anyone noticed. Here is what happened and what it means.
Key points
- A supply-chain attack on LiteLLM, an open-source tool that helps developers build AI software, exposed credentials belonging to more than 2,500 organisations.
- The theft happened in a 40-minute window in March 2025 when victims downloaded a compromised version of LiteLLM from the Python Package Index, the standard online library for Python software.
- Security firms CloudSEK and Hudson Rock disclosed the breach on Tuesday and Wednesday; Hudson Rock found the stolen data inside a 195 TB (terabyte) file.
- Named organisations whose access secrets were exposed include Microsoft, Amazon, Cisco and Samsung, among others.
- Stolen material includes cloud keys, SSH keys (digital passwords for servers) and Kubernetes secrets (credentials that control cloud computing clusters).
A software tool used by thousands of developers to build AI applications was quietly tampered with in March, and the window of theft lasted just 40 minutes. That was long enough.
Security firms CloudSEK and Hudson Rock, first reported by Ars Technica AI, published findings on Tuesday and Wednesday showing that attackers had slipped a malicious version of LiteLLM into the Python Package Index, the central online library where developers download ready-made software components. LiteLLM is an open-source tool that acts as a common layer between AI models and the applications built on top of them, letting developers swap between different AI providers without rewriting their code.
What exactly was stolen?
CloudSEK says the compromised versions harvested cloud keys, repository tokens, SSH keys, Kubernetes secrets, package publishing credentials and environment variables. All of those are the digital equivalents of master keys: whoever holds them can walk into systems, read data and in some cases publish software updates on behalf of the victims.
The firms named Microsoft, Amazon, Cisco and Samsung as just a few of the affected organisations. CloudSEK counts more than 2,500 in total. Hudson Rock made its discovery after analysing a 195 TB file it obtained independently. Neither firm has named the attacker or identified the precise source of that file.
Should ordinary developers and companies be worried?
Yes, if they use LiteLLM and downloaded an update in March without checking its integrity. The attack is a textbook supply-chain compromise: rather than hacking each target directly, the attacker poisoned a shared tool and let the victims come to them. It's a method we've seen before with other open-source components, and it scales brutally well.
A stolen cloud key can expose customer data stored in that account. Any organisation running LiteLLM should audit which version it has installed, rotate any credentials that could have been in use during March, and check access logs for unusual activity.
For context, our 6 August story on AI browser vulnerabilities showed how quickly a compromised AI tool can be weaponised against end users. The principle is the same here, at far larger scale.
What happens next?
Neither security firm has confirmed that affected companies have been individually notified. The Python Package Index maintainers haven't issued a public statement about the compromised package.
Open-source tooling in AI development carries the same supply-chain risks as any other software. What's changed is the blast radius: with AI adoption accelerating, more companies than ever are pulling in packages like LiteLLM without the kind of integrity checks that a 40-minute attack exploits completely.
The honest watch-next here isn't whether the named companies patch fast. It's whether this finally pushes AI development teams to treat package provenance with the same seriousness as network security.
Common questions
What is a supply-chain attack?
Instead of breaking into a company directly, attackers tamper with a tool or software component that the company downloads and trusts. The victims infect themselves without knowing it.
How do I know if my organisation was affected?
Check your LiteLLM version history for any updates applied in March 2025, then rotate all credentials that application could have accessed. Your security or IT team can pull download logs to confirm which version was in use.
