A popular AI developer library shipped a hidden password stealer.
Attackers slipped malware into version 1.107.0 of LiteLLM, a library that connects apps to many AI models, on Wednesday. The poisoned version stole cloud keys, AI tokens and passwords from computers that installed it. LiteLLM removed it after about two hours and tells users to return to 1.106.2 and change every key.
Why it mattersThis is the library's second hijacking in seven months, so check which version your projects use. Tools that hold keys to many AI services have become a favorite target.
Read in the app — free, in 9 languages
Related stories
Governments took websites offline over the AI-found PHP flaw.2026-10-22A startup says AI did most of the work on its new coding model.
2026-10-22Claude's new app checks your work accounts before you ask.
2026-10-22AI helped find a flaw in the language behind most websites.
2026-10-21ChatGPT now lets you lock private chats behind a PIN.
2026-10-21