Fix guides / Security notices

Security notice

A popular AI tool shipped with a hidden password stealer. Check yours now.

Last updated: Sunday, October 25, 2026, 12:59 AM ETStatus: Bad version pulled. Anyone who installed it must clean up now.

On October 21, 2026, version 1.107.0 of LiteLLM, a popular tool developers use to connect apps and websites to AI services, was published with hidden code that steals passwords, cloud logins, keys and other secrets from any computer or server that installed it. A second hidden piece lets the attacker run more code on that machine later. Researchers say it runs every time Python starts on that machine, even if nobody ever uses LiteLLM. The bad version has been pulled, but that does not clean up machines that already installed it, and it does not undo anything already stolen. If anyone builds AI chatbots, AI features or automations for your business, ask them today whether they installed LiteLLM 1.107.0.

Update, October 25, 2026

LiteLLM has published how the attack really happened: a master key leaked in a public code repository in May and was never cancelled. The affected versions and times have not changed. If your developer already checked and cleaned up, there is one new step only for teams that verify LiteLLM's Docker image signatures.

  • It started with a key that was never cancelled. On October 23, LiteLLM published a root cause report that it calls "the canonical source of truth." It says that on May 27, 2026, a settings file containing the master key to an internal LiteLLM agent tool was committed to one of its public code repositories. The mistake was spotted quickly and the file was removed, but "key revocation did not occur for the master key." (LiteLLM root cause report)
  • One key opened everything. LiteLLM says that on October 10, the attacker used that key to get into the agent tool, which handed back a GitHub login token belonging to the owner of LiteLLM's GitHub organization. "From this point onwards, the threat actor had owner-level access to all repositories in our GitHub." The same day, the attacker ran throwaway jobs on LiteLLM's own automated build system that sent it stored secrets, including the GitHub login tokens of two more maintainers. (LiteLLM root cause report)
  • Eleven days later, the bad release. On October 21, LiteLLM says, the attacker used those tokens to point its release process at the lookalike copy Berri-AI/litellm, approve the release, publish 1.107.0 and then delete the records. LiteLLM had relaxed its release approval rules earlier that week to allow more frequent bug fix releases. (LiteLLM root cause report)
  • An earlier explanation was wrong. LiteLLM's first post suspected the tokens came from the logs of an internal LiteLLM deployment. The root cause report says the first token "came from a different service," the agent tool. We have corrected "What happened" below. (LiteLLM root cause report)
  • Same versions, same times. LiteLLM's incident post still lists the same affected files and times: 1.107.0 on PyPI from 7:39 to 9:23 AM ET on October 21, the infected Docker Hub tags from 7:46 to 10:20 AM ET, and the infected GitHub registry tags from 7:46 AM ET until no later than 9:51 AM ET. If a machine installed it or ran those images in that window, the steps below still apply. (LiteLLM)
  • One new step for teams that verify image signatures. On October 24, LiteLLM published new releases, including 1.106.3, signed with a new image-signing key. It says checks that still use the old key "will fail," and that anything pinned to the old cosign.pub must be updated. (LiteLLM 1.106.3 release notes)

LiteLLM says this incident is "a strong illustration of the risks associated with failing to rotate a potentially exposed key." If a password or key ever leaks, even for a moment, cancel it and make a new one. EverThread does not test for this. We cannot see which software your developers or servers installed. (LiteLLM root cause report)

Update, October 22, 2026

LiteLLM has published exact times, how it thinks the attack happened, and a warning: do not run Python or pip to check a machine that may be infected.

  • The bad PyPI package was live from 7:39 to 9:23 AM ET on October 21. The infected Docker Hub tags were live from 7:46 to 10:20 AM ET, and the infected GitHub registry (GHCR) tags from 7:46 AM ET until no later than 9:51 AM ET. Details are under "What happened" below. (LiteLLM)
  • Any Python start on an infected machine runs the malware again, "and that includes running pip," LiteLLM says. Inspect the machine from the shell without launching Python. (LiteLLM, BleepingComputer)
  • Stolen keys are already being tried. Wiz says that from 12:20 to 1:01 PM ET on October 21, about 4.5 hours after the data was sent, the attacker tested stolen Amazon cloud credentials taken from infected build systems and Kubernetes servers. If a machine ran 1.107.0, change its secrets now. (Wiz)

What happened

LiteLLM is free, open source software from a company called BerriAI. Developers use it to connect their apps to more than 100 AI providers, such as OpenAI, Anthropic, Azure, Amazon Bedrock and Google Vertex, through one connection. It runs on developer laptops, in automated build systems and on servers that hold the keys to those AI accounts. (StepSecurity)

Where things stand

Who should worry

A normal website visitor is not at risk from this, and simply using an AI chatbot website is not the same as installing LiteLLM. The danger is on the computers and servers where LiteLLM 1.107.0 was installed, and on every account those machines could log in to.

Ask about this if any of these are true for your business:

If a machine that ran the bad version could log in to your hosting, your store, your cloud account, your email or your payment tools, treat those logins as stolen until they are changed.

If you run a web agency, check your own team's laptops and build systems, and every client project that uses Python and AI features.

What to do now

Do these today.

  1. Ask the question. Send the message below to your developer, agency, host and any AI chatbot or automation vendor. You need a clear yes or no: did any machine that works on your business install LiteLLM 1.107.0, or run its official Docker images on October 21, 2026?
  2. If the answer is yes, treat that machine as broken into. Researchers advise isolating it, cleaning it up or rebuilding it, and then changing every password, key and login it could reach. (AISLE, Cybersecurity News)
  3. Change passwords from a clean device. Change logins for hosting, your store, cloud accounts, email, payment tools and AI services from a computer that never ran the bad version. (Cybersecurity News)
  4. Watch your accounts. Look for logins, charges or changes you did not make in your hosting, cloud, store and AI provider accounts, and ask your developer to review access logs. (Cybersecurity News)
  5. If the answer is "I don't know", that is not a no. Ask them to check using the steps for developers below.

What to send your developer, agency or vendor

LiteLLM 1.107.0 was published to PyPI on October 21, 2026 with a credential stealer and an hourly remote code loader in all seven wheels. It was live on PyPI from 7:39 to 9:23 AM ET. The official Docker images (v1.107.0, latest, main-latest and main-stable) carried the same payload from 7:46 AM ET that day, until 10:20 AM ET on Docker Hub and 9:51 AM ET on GHCR. Please confirm whether any machine, server, container or build system that works on our business installed litellm 1.107.0 or pulled those images. If yes, please treat it as compromised, do not run python or pip on it (that runs the malware again), remove the malicious files from the shell or rebuild it, pin litellm to 1.106.2, rotate every credential it could reach, and tell us which of our accounts were exposed. Sources: LiteLLM post-mortem, StepSecurity, GitHub issue #47826.

Technical steps for developers

These steps come from the researchers' published guidance. Read the StepSecurity analysis for the full list of indicators and file hashes.

Step 1. Find out if you got it

Do not run python, pip or any Python tool on a machine you suspect, including pip show, pip list or pip uninstall. Any Python start runs the malware again. Inspect it from the shell, without launching Python, as in the commands below. (LiteLLM, BleepingComputer)

Search lockfiles and requirements, and check projects that use an open ended litellm>= constraint or a floating image tag, since a fresh install or pull could have resolved to 1.107.0. (StepSecurity)

grep -rniE "litellm[=<>~! ]*1\.107\.0([^0-9rc]|$)" . --include=requirements*.txt --include=*.lock --include=pyproject.toml --include=Pipfile*
find / -name cook.pth -path "*site-packages*" 2>/dev/null
find / -type d -name "litellm-1.107.0.dist-info" 2>/dev/null
ls -la /tmp/.pc_once_72129118c59f5636c0bb /tmp/remote_code_loader.lock 2>/dev/null

Signs of infection: if /tmp/.pc_once_72129118c59f5636c0bb exists, the stealer has already sent data. If it is missing, that proves nothing, because containers and temporary file cleanup remove it. LiteLLM says that if 1.107.0 was ever installed on a machine with internet access, assume the data was sent. Finding cook.pth or a litellm-1.107.0.dist-info folder confirms exposure, but not finding them does not prove the machine is clean. (LiteLLM) If /tmp/remote_code_loader.lock exists, the background loader ran or is still running. (Aikido, StepSecurity) Also check network and DNS logs for requests to litellm.dev and to any path ending in /codepy. StepSecurity says a /codepy request means attacker code ran on that host. (StepSecurity) On Windows the background loader does not work, but the stealer still runs. (StepSecurity)

For containers, check which image digest each deployment actually pulled on October 21:

docker images --digests | grep -E 'berriai/litellm|litellm/litellm'
docker exec <container> ls -la /app/.venv/lib/python3.13/site-packages/cook.pth

Step 2. Contain and clean

  1. Isolate the affected host or runner and keep its logs. (Cybersecurity News)
  2. Stop the background loader: find the process holding /tmp/remote_code_loader.lock with lsof or fuser and kill it. (StepSecurity, AISLE)
  3. Do not start with pip uninstall or pip install, since running pip runs the malware again. "Removing the LiteLLM package directory alone may leave startup files or an active loader behind," BleepingComputer warns. From the shell, delete cook.pth, cook.py and sitecustomize.py, and any matching __pycache__/cook*.pyc and sitecustomize*.pyc files, from every affected site-packages folder, including virtual environments, and stop the background loader. LiteLLM says rebuilding images and virtual environments from scratch is better. (LiteLLM, BleepingComputer)
  4. Only after those files are gone and the loader is stopped, reinstall pinned to litellm==1.106.2, or use the v1.106.2 image pinned by digest, not a floating tag. (LiteLLM, StepSecurity, GitHub issue #47826)
  5. Replace containers built from an infected image instead of cleaning them in place, and purge cached 1.107.0 files from internal registries, PyPI mirrors and caching proxies. StepSecurity reports some mirrors kept serving cached copies after PyPI removed the release. (StepSecurity)

Step 3. Rotate every secret the machine could reach

Cloud access keys and instance roles, SSH and GPG keys, saved browser passwords and sessions, GitHub, npm, PyPI and other registry tokens, Kubernetes and Vault tokens, CI secrets, and AI tool tokens. On LiteLLM proxy hosts, also rotate every provider API key stored in the proxy database, plus the LiteLLM master key and salt key. (StepSecurity) Do it from a clean system. (Cybersecurity News)

Step 4. Block and audit

Block litellm.dev at your DNS resolver or firewall. Search network logs for requests to litellm.dev, to raw.githubusercontent.com/letters9813/ and to any path ending in /codepy. (StepSecurity)

Common questions

Has my business been hacked?

This notice does not mean your business has been hacked. It means a widely used AI tool shipped with malware for part of a day, and anyone who installed it needs to check. Only your developer, agency or vendor can tell you whether their machines installed it.

Can EverThread tell me if I am affected?

No. EverThread checks your website from the outside, the way a browser sees it. It cannot see inside your servers or your developer's computers, and it does not scan Python packages, so it cannot tell whether LiteLLM 1.107.0 was installed or whether anything was stolen. Your developer, agency or vendor can check that. Our free scan looks at your home page from the outside for other common problems, such as an expired padlock certificate, missing browser safety settings and files that should not be public.

I only use ChatGPT or another AI chatbot in my browser. Am I affected?

Using an AI chatbot website or app is not the same as installing LiteLLM. This affects machines where LiteLLM 1.107.0 was installed, or where its infected Docker images ran. If someone built an AI tool for you, ask them.

Is it safe to just update LiteLLM?

No. Updating alone is not enough on a machine that ran 1.107.0, and running pip on that machine to update it starts Python, which runs the malware again. The malicious files and the background loader have to be removed from the shell first, or the machine rebuilt, and the secrets changed. LiteLLM recommends pinning to 1.106.2, the last clean release before the attack, or another exact earlier version rather than taking whatever is newest. (LiteLLM, BleepingComputer)

Where can I follow official updates?

LiteLLM is posting updates in its post-mortem on the LiteLLM blog, its root cause report and on the GitHub issue for this incident. The LiteLLM page on PyPI shows which versions are available.

Security alerts by email

Hear about the next one first.

When a flaw puts websites at risk, we send one plain-English email: what happened, who it affects and what to do. It's free, whether or not you use EverThread.

We email you a link to confirm first, and every alert has a one-click unsubscribe. Alerts can include a short note about EverThread. Already a customer? Use your account email and your alerts include a link to your dashboard. Privacy

Sources

While you are here

Check your site's other basics free. We look at your home page the way a browser does and tell you in plain English. This scan does not check for the LiteLLM malware above. No account.

Or sign up free and we check it every day and email you when something changes.