LiteLLM 1.107.0 compromised: CERT-In warning and what to check
CERT-In's advisory of 23 October 2026 says LiteLLM version 1.107.0, used inside many AI chatbots and automations, was reported to carry a password stealer. You do not install it yourself, but your developer or AI vendor might have.
On this page
On 23 October 2026, CERT-In, India's national agency for cyber security incidents, issued advisory CIAD-2026-0053 on the compromised LiteLLM package. Developers use LiteLLM inside AI chatbots and automations to connect to ChatGPT, Gemini, Claude and other models, and version 1.107.0 was reported to carry a password stealer. You do not install it yourself, but a developer, agency or AI vendor working for you might have. This update is based on CERT-In's advisory, the project's public GitHub issue and the PyPI page, all read on 24 October 2026.
What happened: LiteLLM 1.107.0 was compromised
- CERT-In says version 1.107.0, distributed through PyPI (the Python Package Index), "reportedly" suffered a targeted software supply-chain compromise, and that Docker images on GitHub Container Registry and Docker Hub were also reportedly compromised.
- The project's GitHub issue number 47826 says the 1.107.0 files "contain a credential stealer and a remote-code loader", added before the files were built and not present in the public source tag. Both sources point to a lookalike repository, Berri-AI/litellm, and not the project's real one.
- CERT-In says the code can run whenever Python starts, even if an application never imports LiteLLM, so other Python programs in the same environment may be exposed. The issue adds that the stealing part still runs on Windows.
- According to CERT-In, it tries to collect saved browser passwords and session cookies, SSH and GPG keys, cloud logins for AWS, Azure and Google Cloud, secrets in environment variables, and tokens for tools such as Cursor and GitHub Copilot. On a LiteLLM proxy it may also reach the AI provider keys stored there. A second part can download and run more code.
- The issue's timeline for 21 October 2026: by 13:23 UTC PyPI had removed 1.107.0, and by 17:13 UTC the Docker tags latest, main-latest and main-stable no longer pointed to the bad image. On 24 October 2026 PyPI shows 1.107.0 as "quarantined" and 1.106.2 as the current release. The issue lists 1.106.2 as clean and advises pinning it; CERT-In says to verify it first.
What is not known: how many systems installed the bad version, how the attacker got into the build or publishing process (the issue's authors say they do not know), and which AI tools use LiteLLM inside.
Why it matters for a small business
The risk is not that ChatGPT or Gemini give wrong answers. It is the computer or server where the bad version ran: saved passwords, cloud logins and AI provider keys there may have been copied. In our view, a stolen AI key can be used by someone else while the bill comes to you, and a stolen cloud login can open the door to your website or customer data. See our guide on customer data privacy and AI tools.
If you only use ChatGPT, Gemini or Claude in a browser or phone app, you do not install LiteLLM. CERT-In's advisory is aimed at developers, DevOps and cloud teams. The worry is about the people who build and run AI for you.
Who should care
- Owners whose developer, agency or freelancer built an AI chatbot, assistant or automation.
- Teams that run their own AI gateway or proxy to manage keys for several AI providers.
- Businesses that buy AI software: a vendor may use LiteLLM inside it, and you cannot see that from outside. Our guide on what to check before you pay for an AI tool has more questions to ask.
What changes for you
| Question | Usual habit | Safer habit |
|---|---|---|
| What is inside our AI tools? | Nobody asks | Ask the developer or vendor if LiteLLM is used, and which version |
| Keys and passwords | One key kept in many places | If 1.107.0 ever ran, change them from a clean device |
| Updates | Always take the newest version | Pin a version that has been checked, as CERT-In advises for 1.106.2 |
What to do this week
- List every AI chatbot, assistant and automation built or run for your business, with the person or company who looks after each.
- Send each of them the message below. A written "we do not use LiteLLM" is a good answer.
- If the answer is yes, ask them to follow CERT-In's steps: find every system that installed 1.107.0, rebuild from a clean image and change the keys from "a trusted, clean environment", as CERT-In puts it.
- Check the usage and billing pages of your AI provider accounts for use you do not recognise, and set a spending limit if the provider offers one.
Hello [Name],
CERT-In has published advisory CIAD-2026-0053 about LiteLLM version 1.107.0 (a PyPI package and some Docker images), released on 21 October 2026. Please reply in writing:
- Do the tools, chatbots or automations you built or run for us use LiteLLM, directly or inside another tool?
- If yes, did any computer, server or container ever install or run version 1.107.0, or pull the Docker images latest, main-latest or main-stable?
- If yes, which passwords, API keys and cloud logins could those systems reach, and when will they be changed?
Thank you.
This is general information, not a security audit. If you think a system was affected, involve a qualified security professional. A rule that nobody installs new AI tools on a work computer without asking also helps: see simple AI rules for your team.
What to watch next
- Whether the LiteLLM team explains how the build was compromised, which the issue says is not yet known.
- Whether CERT-In updates advisory CIAD-2026-0053 with new details or more affected versions.
- Whether the agencies and AI vendors you use tell you if they were affected.
Not sure where AI can help your business safely? The free AI Business Checkup takes about three minutes.
