Anyone who installed litellm 1.107.0 during its roughly two hours online Wednesday has been told to rotate every credential the affected machine could reach. LiteLLM has now explained how its own release pipeline built and shipped that poisoned version, and the trail starts with a master key the company meant to revoke back in May.

In a root-cause analysis posted Friday, Director of Security Oliver Jensen and AI engineer Mateo Wang wrote that a configuration file committed to the public LiteLLM-Labs/lite-harness repository on May 27 held the master key for the company’s experimental Agent Platform. The commit was force-pushed over and the key was flagged for revocation. Nobody revoked it.

On Oct. 10, an attacker used it against the platform’s API and got back a GitHub CLI token belonging to one of LiteLLM’s two GitHub organization owners. That token wasn’t tied to a service account or scoped down.…