LiteLLM Confronts Supply-Chain Fallout While Scaling Its AI Gateway Core

On October 21, 2026, LiteLLM suffered its second major supply-chain breach in seven months. Attackers used compromised developer GitHub CLI tokens to hijack the startup’s release pipeline and publish version 1.107.0 to PyPI and Docker Hub. The backdoored release contained a remote access trojan and an infostealer targeting cloud credentials, shell histories, and the internal database where LiteLLM stores API keys for upstream providers like OpenAI and Anthropic.

The incident, detailed in reports by Rescana and Endor Labs, comes during a period of rapid enterprise adoption for the San Francisco startup. Operating with a team of 10 people, the Y Combinator-backed company has 19 open positions across infrastructure, security, and enterprise support. The open headcount highlights the tension at the center of the business: LiteLLM sits directly in the path of critical production secrets, making its build pipelines and runtime systems prime targets for attackers.

Unifying LLMs Under One Proxy

Founded in 2023 by Krrish Dholakia and Ishaan Jaffer, LiteLLM built an open-source Python SDK and proxy server that standardizes calls to more than 100 model APIs—including Amazon Bedrock, Microsoft Azure, Google VertexAI, and Cohere—into the OpenAI request format.

In addition to API unification, the software provides model routing, spend management, latency logging, and monitoring. Enterprises deploy it as a central gateway between internal applications and external model providers. LiteLLM counts Adobe, Twilio, Siemens, and Rocket Money among its users.

Handling production traffic at scale requires resolving provider-specific quirks, such as Azure role handling, while migrating core services to asynchronous networking. The technical roadmap includes standardizing model interfaces to the OpenAI spec and optimizing asynchronous I/O frameworks like FastAPI and aiohttp. To rebuild its lower-level networking and routing engines, LiteLLM is hiring a hybrid Rust Engineer and a Backend Performance Engineer.

Pipeline Breaches and Enterprise Oversight

Because an AI gateway aggregates API keys, database connection strings, and cloud roles in one runtime, any compromise introduces broad downstream risk.

The October 2026 breach occurred after an attacker gained access to an internal LiteLLM deployment exposed to the public internet, extracting GitHub CLI OAuth tokens from deployment logs. According to Cyber Daily, LiteLLM stated that Claude Code had embedded a user's GitHub CLI OAuth token into a response body, which was then recorded in LiteLLM logs. Using a privileged token belonging to an organization owner, the attacker bypassed branch protection rules, pointed the automated release workflow at an external lookalike repository (Berri-AI/litellm), and uploaded poisoned packages to PyPI and Docker Hub before LiteLLM pulled the releases.

Security firm OX Security reported that the malicious wheel contained startup files (cook.pth, cook.py, and sitecustomize.py) designed to execute every time a Python interpreter started in an environment containing the package, harvesting environment secrets and sending them to litellm[.]dev.

This was not the first breach the team faced. In March 2026, The Register reported that LiteLLM versions 1.82.7 and 1.82.8 were compromised when attackers extracted a PyPI publishing token through a subverted Aqua Security Trivy GitHub Action. Days later, TechCrunch reported that LiteLLM replaced its compliance platform Delve with Vanta and engaged independent auditors to verify its internal security controls.

Enterprise security platforms have simultaneously moved to monitor the gateway layer. In June 2026, SecurityBrief Australia reported that CrowdStrike partnered with LiteLLM, Google Cloud, and Microsoft Azure to extend Falcon AI Detection and Response into proxy workflows, giving security teams visibility into prompts and policy enforcement.

The Engineering and Hiring Push

LiteLLM’s 19 listings demonstrate a concerted push to mature its engineering organization, fortify internal architecture, and support enterprise deployments.

The company is establishing dedicated security leadership, hiring an onsite Security Engineer in San Francisco ($200,000–$230,000) and a remote Senior Security Engineer ($220,000–$260,000).

To oversee systems engineering and scaling, LiteLLM is recruiting an onsite Head of Engineering ($250,000–$300,000) and a Staff Engineer ($240,000–$270,000) in San Francisco. Core application development needs are reflected in openings for an onsite Product Engineer ($200,000–$260,000) and a Senior Backend Engineer ($200,000–$260,000).

Customer expansion accounts for the remainder of the roster. LiteLLM is fielding forward deployed engineers to integrate its gateway into enterprise infrastructure, with entry-level and experienced roles listed in the United States and internationally. It is also building out technical support in San Francisco, Brazil, and India, alongside commercial leadership roles like VP of Sales and Technical Account Manager.

Open Roles at LiteLLM

See all open roles at LiteLLM