If your firm uses any AI development tools, connectors, or open-source security scanners, this is worth reading closely.
A new AI attack has exposed terabytes of credentials belonging to more than 2,500 organizations, including Cisco, Samsung, AWS, Airbus U.S. Space & Defense, and the London Stock Exchange Group. The target was LiteLLM, a widely used open-source gateway that connects AI development tools to over 100 large language models. As Ars Technica reported, some of those credentials are still valid nearly five months after the original breach.
This is exactly the kind of quiet, high-impact incident that can sit undetected inside a firm’s environment for months while attackers hold the keys.
What Happened
Attackers didn’t hack LiteLLM directly. Instead, attackers compromised a build of Trivy, a popular open-source security scanner, and used that foothold to slip malicious code into LiteLLM packages on the official Python Package Index (PyPI). During a narrow window in March, anyone who downloaded the compromised package had their secrets siphoned off, all without a single click or obvious warning sign.
The stolen data wasn’t limited to login credentials. Researchers at CloudSEK and Hudson Rock found cloud keys, SSH keys, Kubernetes tokens, environment variables, repository and package-publishing tokens, and AI provider keys, in short, the master keys to a modern software environment. A group calling itself TeamPCP has claimed responsibility, and independent researcher Kevin Beaumont confirmed that some of the exposed credentials still worked when he tested them, even after affected organizations claimed the issue was resolved.
Why This Matters Beyond the Tech Sector
It’s tempting to read this as a story about software developers and DevOps pipelines. It isn’t. This is a story about trust in the software supply chain, and every firm that relies on third-party tools, vendors, or AI-enabled platforms is exposed to the same risk.
For wealth and asset management firms, the concern isn’t just whether your firm uses LiteLLM directly. It’s what this incident reveals about the broader pattern: attackers are increasingly targeting the tools behind the tools, the scanners, package managers, and open-source components that IT and development teams trust implicitly. A single compromised dependency can hand attackers a persistent, hard-to-detect foothold across cloud infrastructure, client systems, and internal repositories.
A breach like this can put at risk:
- Cloud infrastructure and administrative access
- Vendor and third-party system credentials
- Internal development and deployment environments
- Any AI tools or integrations connected to sensitive data
And because the stolen credentials can remain valid for months, the damage isn’t confined to the moment of the breach. It’s an open door that stays open until someone closes it.
What Your Firm Should Do Right Now
1. Inventory your third-party and open-source dependencies. Most firms don’t know the full list of tools, packages, and libraries running underneath their vendors’ platforms. If you can’t ask “were we exposed?”, you can’t answer it.
2. Ask vendors directly about credential rotation (including API keys accessible to past employees). If your firm uses any AI development tools, security scanners, or platforms that integrate with LiteLLM or similar gateways, ask your vendors whether they were affected and whether credentials have been rotated, not just reset.
3. Treat “resolved” claims with healthy skepticism. As this incident shows, some organizations believed they had rotated credentials that were, in fact, still active. Verification matters more than assurances.
4. Make sure you have active monitoring in place. Supply-chain compromises like this one are rarely caught by firewalls or antivirus alone. Continuous monitoring and detection are what catch a stolen key before it’s used against you.
Final Thoughts
Supply-chain attacks are becoming one of the most effective ways for criminals to gain broad, persistent access without ever targeting a firm directly. As AI tools become further embedded in everyday workflows, the attack surface tied to the software behind them will only keep growing.
At BW Cyber, we help wealth and asset management firms understand and reduce this kind of exposure, from vendor risk to continuous monitoring, before it becomes an incident.
Contact BW Cyber to talk through how your firm’s vendor and AI tool exposure stacks up against threats like this one.
