Severity major: Attackers subverted the release workflow and published credential-stealing artifacts, a live production compromise of the release pipeline.
Earliest source we hold 2026-10-28 · Captured by AI Risk Wire 2026-10-28 15:14 UTC
Attackers used a master key exposed in a public repository to retrieve an unscoped GitHub organization-owner token from LiteLLM's internal agent platform, then stole two maintainer tokens, subverted the release workflow and published credential-stealing artifacts.
Risk grouping: Not yet classified
No source we hold states: who caused it, intended or not, before or after release, the ai's part.
The story
1 · What it was doingLiteLLM's internal agent platform held an unscoped GitHub organization-owner token. A master key for that platform was exposed in a public repository.
2 · What went wrongAttackers used the exposed master key to pull the org-owner token, breaching the platform's credential boundary. That identity then let them steal maintainer tokens and subvert the release workflow.
3 · What it reached or didThe action reached GitHub: an organization-owner token, two maintainer tokens and the release workflow. Credential-stealing artifacts were published from it.
What the sources state
What set it off exposed credentials
No source states: how it was caught, when it happened, when it was found, how many records were exposed, the direct loss, a count of the other parties affected, any court case, the cause, what was done.
Show every field, with its source and grade
What happened
Earliest source we hold
2026-10-28
A the date the source itself carries
What set it off
exposed credentials
C one secondary source states it
Who caused it
an outside attacker
C one secondary source states it
What went wrong
security breach
D inferred by us from the described behaviour, reason shown
AI agent
no AI agent acted
D inferred by us from the described behaviour, reason shown
Impact
Severity
major
D inferred by us from the described behaviour, reason shown
Kinds of data exposed
credentials
C one secondary source states it
Why this severity
Attackers subverted the release workflow and published credential-stealing artifacts, a live production compromise of the release pipeline.
D inferred by us from the described behaviour, reason shown
LR-2026-0262 · version 2 · published 2026-10-28 after automatic checks; not yet checked field by field by a person · changes to this case · JSON