{"schema_version":"0.10.0","id":"LR-2026-0466","record_version":1,"title":"SentinelOne blocks Claude-driven zero-day supply chain attack (LiteLLM trojan)","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":52.5,"score_breakdown":{"source_authority":12.1,"independent_corroboration":7.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":6.0,"completeness":5.76,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-11-01","extraction_run_id":null,"evidence_level":{"level":"preliminary","reason":"Publisher not yet named · subject to change","original_document":null,"reports_total":1,"reports_independent":0,"reports_derivative":0,"developing":false,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-11-01","history":[{"date":"2026-11-01","from_level":null,"to_level":"preliminary","reason":"Publisher not yet named · subject to change"}]},"sources_hash":"7e1c7971baa1baf40ff85fdf6215bfb3fbb7dc89ae6bb0b3fd5c5318cb582c0c"},"system":{"model_name":null,"model_version":null,"developer":"Anthropic","harness":"Claude Code","tools_granted":[],"permissions_scope":"unrestricted system permissions","autonomy_level":"full-auto","guardrails_present":[],"deployment_context":"unknown","tier":null,"lifecycle_stage":null,"integration_type":null,"intended_use":null,"safeguard_state":null,"production_intended":null},"event":{"date_occurred":"2026-03-24","date_disclosed":"2026-03-31","incident_class":"security_compromise","failure_class":null,"agent_involved":true,"secondary_failure_classes":[],"trigger":"unknown","duration":null,"detection_method":"automated_monitor","summary":"An autonomous AI coding assistant, Anthropic's Claude Code running with unrestricted permissions, updated the LiteLLM package to a version trojaned by an actor called TeamPCP, which had earlier compromised the security scanner Trivy and used obtained maintainer credentials to publish the malicious releases. The trojaned package attempted to run a multi-stage payload designed to steal data, persist and move laterally. SentinelOne's macOS agent classified the process chain as malicious from its behaviour, without a signature for the package, and killed it preemptively across 424 related events. The vendor reports the attack was launched and caught on March 24, 2026, across multiple customer environments. The account comes from the vendor's own blog and has not been independently verified; the payload's later stages were stopped before they could deploy.","tags":[],"date_detected":"2026-03-24","near_miss":null,"root_cause":null,"root_cause_detail":null,"failure_class_detail":null,"responsible_party":null,"adversarial_actor":"external_attacker","input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":null,"precursor_events":null,"primary_risk":"RK02","control_chain":[{"layer":"L3","party":"deployer","party_name":"SentinelOne","control_id":"F1","outcome":"held","reason":null,"quote":"The SentinelOne macOS agent traced every branch of this tree, correlated the events back to the root cause, and killed the malicious execution; all while preserving the full forensic record for investigation.","source_index":0,"reviewed":false},{"layer":"L3","party":"deployer","party_name":null,"control_id":"B1","outcome":"missing","reason":null,"quote":"an AI coding assistant running with unrestricted system permissions autonomously updated LiteLLM to the trojaned version without human review.","source_index":0,"reviewed":false}]},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"moderate","severity_because":"Test: moderate (data or systems of others touched, bounded scope stated as multiple customer environments). No count of affected parties is stated.","harm_class":[],"affected_description":"Multiple customer environments; no count stated","protected_class_involved":null,"data_categories_exposed":[],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://www.sentinelone.com/blog/how-sentinelones-ai-edr-autonomously-discovered-and-stopped-anthropics-claude-from-executing-a-zero-day-supply-chain-attack-globally/","publisher":"SentinelOne","date":"2026-03-31","type":"press","title":"How SentinelOne’s AI EDR Autonomously Discovered and Stopped Anthropic’s Claude from Executing a Zero Day Supply Chain Attack, Globally - SentinelOne","archived_url":null,"attachment":"first_report"}],"per_field_confidence":{"system.permissions_scope":"C","system.developer":"C","system.harness":"C","system.autonomy_level":"C","event.date_occurred":"C","event.date_detected":"C","event.agent_involved":"C","event.incident_class":"C","event.detection_method":"C","event.adversarial_actor":"C","impact.affected_description":"C","impact.severity":"D","impact.severity_because":"D","event.primary_risk":"D","event.control_chain":"C","event.summary":"C","system.deployment_context":"D","event.trigger":"D","context.country":"D","event.date_disclosed":"D","context.denominator_available":"D"},"field_citations":{"system.permissions_scope":[{"source_index":0,"quote":"In one customer environment, SentinelOne detected the infection arriving through an unexpected vector: an AI coding assistant running with unrestricted system permissions autonomously updated LiteLLM to the trojaned version without human review."}],"system.developer":[{"source_index":0,"quote":"SentinelOne’s macOS agent identified and preemptively killed a malicious process chain originating from Anthropic’s Claude Code running with unrestricted permissions (claude --dangerously-skip-permissions)."}],"system.harness":[{"source_index":0,"quote":"The process tree expands from Claude Code (2.1.81) into a sprawling chain: zsh, bash, node, uv, ssh, rm, python3.12, mktemp, with hundreds of child events still loadable (304 events captured)."}],"system.autonomy_level":[{"source_index":0,"quote":"No human developer ran pip install, an autonomous AI coding assistant updated LiteLLM to the compromised version as part of its normal workflow."}],"event.date_occurred":[{"source_index":0,"quote":"On March 24, 2026, SentinelOne’s autonomous detection caught what manual workflows never could have: a trojaned version of LiteLLM, one of the most widely used proxy layers for LLM API calls, executing malicious Python across multiple customer environments."}],"event.date_detected":[{"source_index":0,"quote":"On March 24, 2026, SentinelOne’s autonomous detection caught what manual workflows never could have: a trojaned version of LiteLLM, one of the most widely used proxy layers for LLM API calls, executing malicious Python across multiple customer environments."}],"event.agent_involved":[{"source_index":0,"quote":"No human developer ran pip install, an autonomous AI coding assistant updated LiteLLM to the compromised version as part of its normal workflow."}],"event.incident_class":[{"source_index":0,"quote":"On March 24, 2026, SentinelOne’s autonomous detection caught what manual workflows never could have: a trojaned version of LiteLLM, one of the most widely used proxy layers for LLM API calls, executing malicious Python across multiple customer environments."}],"event.detection_method":[{"source_index":0,"quote":"The AI engine classified the behavior as MALICIOUS and took immediate action: KILLED (PREEMPTIVE) across 424 related events in under 44 seconds."}],"event.adversarial_actor":[{"source_index":0,"quote":"The attacker, operating under the alias TeamPCP, never attacked LiteLLM directly."}],"impact.affected_description":[{"source_index":0,"quote":"SentinelOne detected and blocked this attack autonomously, on the same day it was launched, across multiple customer environments."}],"impact.severity":[{"source_index":0,"quote":"SentinelOne detected and blocked this attack autonomously, on the same day it was launched, across multiple customer environments."}],"impact.severity_because":[{"source_index":0,"quote":"SentinelOne detected and blocked this attack autonomously, on the same day it was launched, across multiple customer environments."}],"event.control_chain":[{"source_index":0,"quote":"The SentinelOne macOS agent traced every branch of this tree, correlated the events back to the root cause, and killed the malicious execution; all while preserving the full forensic record for investigation."},{"source_index":0,"quote":"an AI coding assistant running with unrestricted system permissions autonomously updated LiteLLM to the trojaned version without human review."}],"event.summary":[{"source_index":0,"quote":"SentinelOne’s macOS agent identified and preemptively killed a malicious process chain originating from Anthropic’s Claude Code running with unrestricted permissions (claude --dangerously-skip-permissions)."},{"source_index":0,"quote":"From there, they obtained the LiteLLM maintainer’s PyPI credentials and used them to publish two malicious versions: 1.82.7 and 1.82.8."},{"source_index":0,"quote":"The AI engine classified the behavior as MALICIOUS and took immediate action: KILLED (PREEMPTIVE) across 424 related events in under 44 seconds."},{"source_index":0,"quote":"On March 24, 2026, SentinelOne’s autonomous detection caught what manual workflows never could have: a trojaned version of LiteLLM, one of the most widely used proxy layers for LLM API calls, executing malicious Python across multiple customer environments."}]},"notes_on_gaps":"Single source: a vendor blog by SentinelOne, the detecting party, not the implicated developers. Its claims are not independently verified, and no statement from Anthropic, LiteLLM or the affected customers appears. Date of disclosure is not stated in the body text (only the page header dates the post 2026-03-31), so date_disclosed is left out. The year of the Trivy compromise (March 19) is not stated in that sentence. The 'under 44 seconds' containment time is a bound, not an exact value, so no duration is recorded. The source does not say whether the payload ran in any customer environment beyond the kill, nor whether data was stolen, so no records, data categories or loss are recorded. No count of affected customers or third parties is stated ('thousands of organizations' describes package use, not affected parties). Severity moderate is my judgement from the bounded scope 'across multiple customer environments'. Root cause as integration (supply chain via a dependency) and adversarial_actor as external_attacker are my judgements. No failure_class or trigger is written because no listed value fits what the source states. Model name, model version, lifecycle stage, deployment context, industry, country and tools granted are not stated. No remediation by the implicated parties is reported, so remediations is empty. Controls on dependency vetting and signing (G1, G3) are not stated as held or missing, so they are not listed. [case created by the backfill: read by claude-haiku-5-5, backfill-2026-11-01.2, 2026-11-01; not yet reviewed] [2026-11-01: evidence level set: Preliminary (Publisher not yet named · subject to change)]"},"context":{"industry":null,"org_size_band":null,"country":"unknown","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"doing","text":"Claude Code running with unrestricted permissions updated LiteLLM to the compromised version as part of its normal workflow.","quote":"No human developer ran pip install, an autonomous AI coding assistant updated LiteLLM to the compromised version as part of its normal workflow.","source_index":0,"grade":"C"},{"step":"went_wrong","text":"The update pulled the trojaned package and the payload attempted to run.","quote":"The update pulled the infected package, and the payload attempted to execute.","source_index":0,"grade":"C"},{"step":"reached","text":"The payload was built as a multi-stage system, each stage decoding and executing the next.","quote":"The attack was structured as a multi-stage delivery system, each stage decoding, decrypting, and executing the next.","source_index":0,"grade":"C"},{"step":"caught","text":"The behavioural engine classified the process chain as malicious and killed it preemptively.","quote":"The AI engine classified the behavior as MALICIOUS and took immediate action: KILLED (PREEMPTIVE) across 424 related events in under 44 seconds.","source_index":0,"grade":"C"}],"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://www.sentinelone.com/blog/how-sentinelones-ai-edr-autonomously-discovered-and-stopped-anthropics-claude-from-executing-a-zero-day-supply-chain-attack-globally/"]},"analysis":{"sections":{"timeline":[{"text":"Attacker compromised Trivy","quote":"They first compromised Trivy, a widely trusted open-source security scanner, on March 19.","source_index":0,"when":"March 19"},{"text":"Same actor compromised Checkmarx KICS and AST","quote":"The same actor went on to compromise Checkmarx KICS and AST on March 23, and Telnyx on March 27.","source_index":0,"when":"March 23"},{"text":"Trojaned LiteLLM executed; SentinelOne agent detected the attack","quote":"On March 24, 2026, SentinelOne’s autonomous detection caught what manual workflows never could have: a trojaned version of LiteLLM, one of the most widely used proxy layers for LLM API calls, executing malicious Python across multiple customer environments.","source_index":0,"when":"March 24, 2026"},{"text":"Malicious process chain killed preemptively across 424 related events in under 44 seconds","quote":"The AI engine classified the behavior as MALICIOUS and took immediate action: KILLED (PREEMPTIVE) across 424 related events in under 44 seconds.","source_index":0,"when":null},{"text":"Same actor compromised Telnyx","quote":"The same actor went on to compromise Checkmarx KICS and AST on March 23, and Telnyx on March 27.","source_index":0,"when":"March 27"}]},"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://www.sentinelone.com/blog/how-sentinelones-ai-edr-autonomously-discovered-and-stopped-anthropics-claude-from-executing-a-zero-day-supply-chain-attack-globally/"]}}