AI agent incident

A supply chain compromise reached LiteLLM users through Trivy

Reported · 3 sources

  • supply-chain
  • credential-theft

What happened

Malicious LiteLLM releases on PyPI were initially blamed for exposing data from more than 2,100 organizations, but researchers later concluded that a Trivy vulnerability was the actual cause, with more than 95 percent of victims exposed before the LiteLLM packages appeared. Australian police charged two men over the TeamPCP attacks that compromised Trivy, Checkmarx KICS, and LiteLLM in March 2026.

Why it matters

The first attribution was wrong, and teams that removed LiteLLM without patching Trivy fixed the wrong thing. It is a good case for why an incident record should carry the correction next to the original report.

Sources

  1. The Hacker News Malicious LiteLLM Releases Tied to Trivy Hack May Have Exposed 2,100+ Organizations
  2. SecurityWeek Trivy, Not LiteLLM Behind the 2,500 Org Compromise
  3. The Hacker News Alleged TeamPCP Hackers Charged in Australia Over Major Supply Chain Attacks

New incidents by email

Get incidents like this one in your inbox

New AI agent incidents are covered in the briefing, with what to check on the agents you already run. At least once a week, free.

You confirm by email. Unsubscribe in one click.

Background reading

Agent plugins and skills are a supply chain An explainer on the problem behind this incident.

Cite or correct this record

“A supply chain compromise reached LiteLLM users through Trivy.” The Permission Layer AI Agent Incident Database, https://thepermissionlayer.com/incidents/litellm-trivy-supply-chain/. Database updated October 22, 2026.

Every record traces to the dated sources above. If something here is wrong or missing, email [email protected] and it gets fixed. See this record in the full list.

The Permission Layer

Get the briefing by email

At least one email a week on AI agent identity, permissions, security and spend, written for the people who approve agent access. Five-minute read, free.

You confirm by email. Unsubscribe in one click.