Skip to main content
Incident intelligence/SS-IR-075CASE FILE OPEN
Symbolic editorial illustration for SS-IR-075SERVANTSTACK // INCIDENT INTELLIGENCEFORENSIC IMAGE // VERIFIED FRAME
SS-IR-075 // INCIDENT REPORTReported

AI Supply Chain Attacks

Poisoned CI/CD Pipelines Compromise LiteLLM and Open-Source AI Tools

EXECUTIVE BRIEF

A coordinated campaign targeted the AI software supply chain by compromising multiple open-source projects' CI/CD pipelines to steal credentials and inject malicious code .

DATA & CYBER SECURITY
FAILURE CHAINTRACE COMPLETE
  1. 01TRIGGERA coordinated campaign targeted the AI software supply chain by compromising multiple open-source projects' CI/CD…
  2. 02MACHINE ACTIONAdvisory output
  3. 03MISSING GATETrust boundaries, least privilege, and output approval
  4. 04IMPACTData security
01 // INCIDENT SUMMARY

The short version

A coordinated campaign targeted the AI software supply chain by compromising multiple open-source projects' CI/CD pipelines to steal credentials and inject malicious code .

02 // KEY FACTS

Case telemetry

INCIDENT
SS-IR-075
DATE
March 19-31, 2026
SYSTEM
AI Supply Chain Attacks
LOCATION / SCOPE
Global
EVIDENCE
Reported
AI ROLE
Advisory output
HARM
Data security
SOURCES
1 cited record
03ENTRY POINT // WHAT HAPPENED

The event

A coordinated campaign targeted the AI software supply chain by compromising multiple open-source projects' CI/CD pipelines to steal credentials and inject malicious code. The attackers poisoned build systems used by popular AI development tools, ultimately compromising LiteLLM - a massively popular AI proxy used by thousands of organizations to route requests across AI providers. The poisoned builds were distributed through standard package management channels, putting millions of developer environments at risk. Organizations using the compromised tools unknowingly ran attacker-controlled code with access to their AI API keys, cloud credentials, and internal networks.

04CAUSAL TRACE // AI'S ACTUAL ROLE

What the machine did

The AI supply chain has become a high-value target because AI tools operate with broad system access - API keys to multiple providers, cloud credentials, access to codebases, and often elevated permissions. The automated dependency management systems that make AI development fast also make it fragile: a compromised upstream package propagates instantly to every dependent project. No human reviewed the poisoned packages before they were pulled into production environments. The same "automate everything" philosophy that accelerates AI development also accelerated the attack's propagation.

Advisory outputAutomation was a causal participant—not a decorative label for the system around it.
05BLAST RADIUS // CONSEQUENCES

Where the failure landed

Millions of developer environments potentially compromised. AI API keys and cloud credentials stolen at scale. Organizations' AI infrastructure - including model access, training data, and deployment pipelines - exposed to attackers. The incident revealed that the AI ecosystem's heavy reliance on open-source tooling creates a supply chain attack surface that most organizations don't monitor or secure. Trust in automated dependency management was fundamentally undermined.

06 // EVIDENCE STATUS

Reported

Documented in the cited public record. Follow the sources for the precise evidentiary posture.

SOURCE RECORD UPDATED 2026-07-09

07 // SOURCE LEDGER

1 cited record

  1. 01
08CONTROL FAILURE // MISSING GOVERNANCE

Trust boundaries, least privilege, and output approval

The failure pattern in this case: Untrusted input crossed a privileged boundary.

09INTERVENTION POINT // HUMAN IN THE MIDDLE

The moment the path could change

A security owner approves credential scope and externally visible actions before the agent can cross a trust boundary.

AI PROPOSES→HUMAN OWNS THE DECISION→SYSTEM EXECUTES
10CONTROL DEPLOYMENT // AUTHORITYGATE

Trust boundary policy · output approval

AuthorityGate's framework requires human security review of all dependency updates before deployment to production. Automated dependency updates should never propagate to production without a security SME reviewing changelogs, verifying package integrity, and confirming source authenticity. The framework mandates pinned dependencies with human-approved update cycles - not automatic "latest version" pulls that trust the supply chain implicitly.

DIRECT AUTHORITYGATE ANALYSISSupply Chain Attack via Poisoned CI/CDThe detailed analysis of poisoned AI tooling, compromised build pipelines, and downstream credential exposure.
12 // THE ALTERNATIVE

Autonomy is a design choice.

See the operating model that keeps AI useful while preserving human authority at consequential moments.

Compare AgenticAI and AugmentedAI →