Over 2,500 organisations worldwide may have been exposed in a major AI software supply-chain incident involving LiteLLM, an open-source tool used by applications to connect with AI models.

The organisations linked to the exposure operate across several sectors, including technology, banking, finance, telecom, cybersecurity, manufacturing, logistics and enterprise software, according to CloudSEK.

Major companies linked to the exposure

CloudSEK’s analysis found high-confidence links to organisations including NVIDIA, Samsung Electronics, Cisco Systems, Siemens, S&P Global, ServiceNow, Deloitte, Vodafone, X Corp, Zscaler, FedEx, Volkswagen, Thales and London Stock Exchange Group.

ALSO READ | OpenAI, Anthropic AI agents implicated in new security breaches

Being included in the dataset does not necessarily mean that an organisation was hacked or that its data was stolen. It means potentially exposed information connected to the organisation was identified and needs to be checked.

Sensitive credentials may have been exposed

The information potentially accessible through affected environments included cloud credentials, source-code access, server keys, development secrets and AI API keys. If attackers obtained valid credentials, they could potentially access cloud accounts, internal servers and software-development systems.

Such access could also allow attackers to steal source code, misuse AI services, move further into corporate networks or use genuine company credentials to make malicious activity harder to detect.

Malicious LiteLLM package available for around 40 minutes

The incident took place in March 2026, when cybercriminal group Team PCP compromised LiteLLM. Malicious versions of LiteLLM were reportedly available on PyPI, the Python package repository, for around 40 minutes.

ALSO READ | Claude mythos wake-up call: What AI vulnerability discovery means for cyber defense

Around 434,000 CI/CD pipelines were potentially linked to the exposure, according to CloudSEK’s analysis, despite the malicious package being available for a limited time frame.

CI/CD systems automatically build, test and deploy software and can download packages without developers manually checking every component. As a result, a malicious package can quickly reach a large number of corporate systems.

Credentials at risk

CloudSEK identified several types of credentials that may have been exposed, including AWS, Google Cloud and Microsoft Azure credentials, along with source-code repository credentials, SSH keys, Kubernetes tokens, CI/CD secrets and AI API keys.

These credentials are used by employees, applications and automated systems to access business infrastructure.

If stolen, attackers could potentially use them to enter systems directly rather than breaking through security controls.

Removing the package may not end the risk

The removal of the malicious LiteLLM package does not automatically eliminate the threat. If attackers copied credentials while the package was compromised, those credentials could remain usable until companies change or revoke them.

The stolen credentials could potentially be used later to access systems, steal sensitive information, compromise software or support further cyberattacks.

Why the incident matters

The incident highlights the wide-reaching impact of software supply-chain attacks. Instead of targeting thousands of companies separately, attackers can compromise a software tool that is widely used and trusted by organisations.

Once compromised software enters automated development environments, it can potentially expose credentials and systems across multiple organisations at the same time.

In this case, a compromise lasting around 40 minutes was potentially linked to more than 2,500 organisations and approximately 434,000 development pipelines, showing how a single attack on widely used AI software can create security risks for businesses worldwide.