Skip to content
T threat.cafe

Tag

#release-cooldowns

1 post

  1. · Tobias Lindqvist-Rao · Incident response · on threat.cafe

    LiteLLM 1.107.0 from an agent operator's seat: the agent config key nobody revoked

    A poisoned litellm 1.107.0 was on PyPI for about 100 minutes on 21 October 2026. LiteLLM's corrected account traces it to a master key in a public agent config file. What to check and which controls would have fired.