AI Risk Wire

Cases › security breach › LR-2026-0466

SentinelOne blocks Claude-driven zero-day supply chain attack (LiteLLM trojan)

Preliminary Why: Publisher not yet named · subject to change

Status: no action reported

Severity moderate
Reported 31 Mar 2026
Developer and model Anthropic
Agent tool Claude Code

No source states: loss or records, could do, deployer, industry.

Severity moderate: Test: moderate (data or systems of others touched, bounded scope stated as multiple customer environments). No count of affected parties is stated.

An autonomous AI coding assistant, Anthropic's Claude Code running with unrestricted permissions, updated the LiteLLM package to a version trojaned by an actor called TeamPCP, which had earlier compromised the security scanner Trivy and used obtained maintainer credentials to publish the malicious releases. The trojaned package attempted to run a multi-stage payload designed to steal data, persist and move laterally. SentinelOne's macOS agent classified the process chain as malicious from its behaviour, without a signature for the package, and killed it preemptively across 424 related events. The vendor reports the attack was launched and caught on March 24, 2026, across multiple customer environments. The account comes from the vendor's own blog and has not been independently verified; the payload's later stages were stopped before they could deploy.

What happened

1 · What it was doingClaude Code running with unrestricted permissions updated LiteLLM to the compromised version as part of its normal workflow.
2 · What went wrongThe update pulled the trojaned package and the payload attempted to run.
3 · What it reached or didThe payload was built as a multi-stage system, each stage decoding and executing the next.
4 · How it was caughtThe behavioural engine classified the process chain as malicious and killed it preemptively.

What was done

No source states an action or fix.

Risks

Agent takes destructive or unapproved actions
Primary63 incidents
Rising: 5 vs 2.2 a week

Read from the sources; not yet reviewed by a person.

Controls

Application

Effective Activity logs
Did not exist Human approval for high-impact actions

Control failure chain

L1 · Model Not stated in sourcesAnthropic
L2 · Harness Not stated in sourcesClaude Code
L3 · Application Did not existDeployer not named
L4 · Infrastructure / target Not stated in sourcesOrganisation hit

L1 · ModelAnthropicModel provider

No source mentions a control at this layer.

Model version not linked to a model card.

L2 · HarnessClaude CodeAgent framework vendor

No source mentions a control at this layer.

Other controls for this risk at this layer, not mentioned in the sources: Tool allow-list, Fail-closed defaults, Stop control.

L3 · ApplicationDeployer not namedDeployer

EffectiveActivity logs“The SentinelOne macOS agent traced every branch of this tree, correlated the events back to the root cause, and killed the malicious execution; all while preserving the full forensic record for investigation.”SentinelOne
Did not existHuman approval for high-impact actions“an AI coding assistant running with unrestricted system permissions autonomously updated LiteLLM to the trojaned version without human review.”SentinelOne

Other controls for this risk at this layer, not mentioned in the sources: Change review and separation of duties, Least-privilege access for the agent, Production kept apart from test, Adversarial testing before deployment.

L4 · Infrastructure / targetOrganisation hit

No source mentions a control at this layer.

Other controls for this risk at this layer, not mentioned in the sources: Backups and recovery.

EffectiveNot effectiveNot effective (bypassed)Did not existNot stated in sourcesNot yet checkedAttacker's ownOrder: model · harness · application · target

Controls for this risk: result in this incident

ControlPart of the systemResult
Tool allow-listL2 HarnessNot stated in sources
Stop controlL2 HarnessNot stated in sources
Fail-closed defaultsL2 HarnessNot stated in sources
Human approval for high-impact actionsL3 ApplicationDid not exist
Activity logsL3 ApplicationEffective
Least-privilege access for the agentL3 ApplicationNot stated in sources
Production kept apart from testL3 ApplicationNot stated in sources
Change review and separation of dutiesL3 ApplicationNot stated in sources
Adversarial testing before deploymentL3 ApplicationNot stated in sources
Backups and recoveryL4 Infrastructure / targetNot stated in sources

Similar incidents

Anthropic Claude Code source code leaked through npm packaging error2026-03-31
Claude in Chrome indirect prompt injection chain: inbox exfiltration, Drive persistence and account takeover2026-08-05
AI-assisted exploitation of PHP2Shell and Fragnesia flaws to breach 25 servers across four countries2026-10-29
Claude-abused credential-harvesting pipeline decompiling 1.8 million Android APKs2026-10-26

All cases of this kind ›

Evidence

No source states: how many records were exposed, the direct loss, a count of the other parties affected, any court case, the cause, what set it off, what was done.

Show the full account: 5 items from the primary sources

What happened, in order

  1. March 19 Attacker compromised Trivy
  2. March 23 Same actor compromised Checkmarx KICS and AST
  3. March 24, 2026 Trojaned LiteLLM executed; SentinelOne agent detected the attack
  4. March 27 Same actor compromised Telnyx

Not dated in the sources:

  • Malicious process chain killed preemptively across 424 related events in under 44 seconds
Show every field, with its source and grade

The AI system

Developer
Anthropic
C one secondary source states it
Software around the model
Claude Code
C one secondary source states it
What it was allowed to do
unrestricted system permissions
C one secondary source states it
How much it acted alone
it acted alone, unwatched
C one secondary source states it

What happened

When it happened
2026-03-24
C one secondary source states it
Earliest source we hold
2026-03-31
D inferred by us from the described behaviour, reason shown
Who caught it
automated monitoring
C one secondary source states it
Who caused it
an outside attacker
C one secondary source states it
What went wrong
security breach
C one secondary source states it
AI agent
an AI agent acted
C one secondary source states it
primary risk
RK02
D inferred by us from the described behaviour, reason shown
control chain
layer: L3; party: deployer; party name: SentinelOne; control id: F1; outcome: held; quote: The SentinelOne macOS agent traced every branch of this tree, correlated the events back to the root cause, and killed the malicious execution; all while preserving the full forensic record for investigation.; source index: 0, layer: L3; party: deployer; control id: B1; outcome: missing; quote: an AI coding assistant running with unrestricted system permissions autonomously updated LiteLLM to the trojaned version without human review.; source index: 0
C one secondary source states it

Impact

Severity
moderate
D inferred by us from the described behaviour, reason shown
Who was affected
Multiple customer environments; no count stated
C one secondary source states it
Why this severity
Test: moderate (data or systems of others touched, bounded scope stated as multiple customer environments). No count of affected parties is stated.
D inferred by us from the described behaviour, reason shown

Notes on gaps

Its claims are not independently verified, and no statement from Anthropic, LiteLLM or the affected customers appears. The year of the Trivy compromise (March 19) is not stated in that sentence. No remediation by the implicated parties is reported, so remediations is empty. Controls on dependency vetting and signing (G1, G3) are not stated as held or missing, so they are not listed.

LR-2026-0466 · version 1 · published 2026-11-01 after automatic checks; not yet checked field by field by a person · JSON