The update that stole passwords from AI apps

A few hours were enough

On October 21, 2026, a widely used artificial intelligence tool published a poisoned update. It was only available for a few hours, but that was enough. The most unsettling part is how it reached people: nobody opened a strange email or clicked a sketchy link. They simply did what everyone is told to do, which is update. That is why this matters even if your business has no tech team of its own. The danger came through the channel we all consider safe.

AI apps are built from other people's parts

In 2015, Google gave away TensorFlow, its artificial intelligence tool, so anyone could use it. Today almost every AI app is built that way, from free parts made by others, much like a restaurant that buys its bread already baked. LiteLLM is one of those parts. It works like a switchboard that connects an app to different artificial intelligence models. The attackers did not go after the apps directly. They went after the part many of them rely on behind the scenes.

It came in through the front door

That day, LiteLLM version 1.107.0 was released. It arrived through PyPI, the official Python package store, and through the project's own ready-to-run copies. Anyone who updated or launched a fresh copy during that window got it. The trick was in startup: the code woke up every time Python started, the language these apps run on, even if the app never used LiteLLM. The app kept working as usual while, underneath, the code hunted for credentials, the keys that unlock other systems.

A short path, a longer investigation

The attack path was very short. The version goes out, someone installs it, Python starts, and the keys on that machine are exposed. Nothing else was needed. The LiteLLM project says it has already pulled that version from its official channels. Two days later, Microsoft published an analysis explaining how the malicious code worked on the inside. The update was online for only a few hours, but understanding everything it did took days of work.

What is confirmed and what is not

According to Microsoft, the code could reach cloud keys, browser data, server access keys, and developer tool credentials, plus data from LiteLLM itself. The project says its private enterprise version was not affected. It also does not affect people who only use their phone, browse a website, or run a different version, unless their server had that compromised install. Who is behind the attack has not been confirmed.

Pulling it isn't enough: cleanup is required

Seven packages were removed from PyPI, along with four versions of the official ready-to-run copies. But that does not fix machines where it was already installed. Anyone who had it needs to rebuild the environment from scratch, delete the files the attack left behind, stop the Python process that kept running, and roll back to a known good version, such as 1.106.2. They also need to change every key stored on or reachable from that machine, especially cloud and database credentials.

Locking the version made the difference

In this case, a single setting separated the people who were hit from those who were not. An app with its version locked stays on the one that already works until someone reviews the new one before installing it. An app set to automatically grab the latest version swallowed the poisoned update the same day it came out. The first one waited and stayed safe. The second one trusted the official channel and received the malicious code without anyone noticing.

Four things to ask your developer

1. 1. Ask them to lock the version of every part of the app instead of automatically installing "the latest."
2. 2. Ask them to run the AI app separately, with no cloud keys within its reach.
3. 3. If anyone installed version 1.107.0, ask them to change every key on that machine today.
4. 4. Check the official notice at docs.litellm.ai or ask whoever built your app whether it was exposed.

If your business has an AI app or chatbot, you do not need to know how to code to protect it. Just ask whoever maintains it for the following.