LiteLLM, an open-source AI gateway, says attackers published a poisoned version of its software on Wednesday using credentials they took from its own logs.
The company laid out its account in an incident report signed by its chief executive, chief technology officer and director of security. It said GitHub tokens leaked via Claude Code, Anthropic's coding agent, and that its engineers identified the tool as involved. The excerpt of the account available to us does not spell out the steps in between.
A gateway, in this context, is software that sits between an application and one or more AI model providers, routing requests through a single interface. Developers pull it into their own projects, which is why a tampered release matters: the bad code arrives through the channel users already trust. The GitHub tokens are what gave the attackers that channel.
Three senior signatures also make this the company's formal account rather than an engineer's post-mortem.
The pattern is not new. In 2021, attackers used a credential exposed in Codecov's own build process to alter a widely used developer tool, and customers ran the modified version. What stands out here is the named link in the chain, an AI coding agent, which has rarely appeared in an incident report of this kind.