TL;DR
- LiteLLM 1.107.0 — published to PyPI October 21 — contained a credential stealer and remote access trojan that ran automatically on every Python process startup, including processes that never import LiteLLM. It targeted SSH keys, AWS/Azure/GCP credentials, Kubernetes secrets, LLM provider API keys (OpenAI, Anthropic, Cohere), and the LiteLLM proxy's own credential database. Available on PyPI for 1 hour 44 minutes, Docker tags for 2 hours 34 minutes. LiteLLM has ~23 million weekly downloads. If your environment ran litellm==1.107.0 or pulled the `latest`, `main-latest`, or `main-stable` Docker tags between 11:39 and 14:20 UTC on October 21, treat all credentials on that host as compromised. Downgrade to litellm==1.106.2 — but delete the malware files before running pip.
- Storm-0940, a China-state-aligned threat actor active since 2021, used ARTEX — an open-source LLM-driven agentic penetration testing framework — to attack more than 2,250 Microsoft 365 tenants at 2,900 sign-in attempts per minute. The attack exploited the ConnectWise supply chain compromise (advisory October 16) to abuse OAuth credentials that ConnectWise cloud apps already held inside target tenants. Between October 10-14, Storm-0940 sprayed 327 accounts across eight organizations, generating 151,000+ failed logon events. Microsoft confirmed Storm-0940 authenticated successfully to multiple customer environments. This is the first large-scale nation-state campaign documented using AI agents as the primary offensive execution layer.
- Microsoft embedded Guardian Agents into Project Perception this week — AI security monitors that watch autonomous workplace AI agents and can pause or terminate them. Microsoft's Chief Security Officer: frontier models "cannot be trusted" and must be treated like insider threats, requiring permanent background monitoring and the ability to pause them at any moment — consistent with Nadella's "emergency brake" essay from October 10.
- Mistral released Large 4 ("le Chonk"): 1T-parameter open-weight MoE, 52B active parameters, top-5 on coding benchmarks, Apache 2.0, late October release.
Two events this week made the same argument from opposite sides of the same attack.
LiteLLM is a library that enterprises use to route calls to LLM providers — OpenAI, Anthropic, Google. Its proxy database is exactly where API keys live. The supply-chain attack on October 21 targeted that specific table (`LiteLLM_CredentialsTable`) alongside every other credential on the host. The AI infrastructure that enterprises built to use AI models became the attack surface.
Storm-0940 used ARTEX — an open-source LLM-driven agent framework — to attack 2,250 Microsoft 365 tenants at machine speed. An AI agent ran autonomous reconnaissance, password spraying, and OAuth abuse with "little needed human interaction." The AI attack tool was used by the attacker.
Microsoft's response to both: embed Guardian Agents that watch your AI agents the way security monitors watch human employees. The same week its own infrastructure was attacked using AI tools, Microsoft told enterprises to treat the frontier models running inside their systems like insider threats.
The LiteLLM supply-chain attack
LiteLLM version 1.107.0 was uploaded to PyPI at 11:39 UTC on October 21. PyPI removed it at 13:23 UTC. Docker tags (`latest`, `main-latest`, `main-stable`, `v1.107.0`) served the compromised image until 14:20 UTC.
The attack method: three GitHub CLI OAuth tokens belonging to LiteLLM engineers were stolen. One account was used to override branch protection and modify the private release workflow. A second approved the production release. A third deleted workflow records to limit forensic logs. The build was run against a lookalike repository — `Berri-AI/litellm`, distinguished from the legitimate `BerriAI/litellm` by a single hyphen — to generate wheels with seemingly legitimate build provenance.
The payload installed three files into Python's site-packages directory:
`cook.pth` causes `cook.py` to be imported every time Python starts — on any process, anywhere on the host, including processes that never import LiteLLM. `cook.py` is a credential stealer across 16 collection modules. `sitecustomize.py` spawns a background daemon that runs the stealer again every hour and downloads fresh code from an attacker-controlled server for execution.
What was stolen: AWS credentials (including EC2 instance metadata via IMDSv2/v1), Azure CLI token cache, Google Cloud service account keys, Kubernetes configs, Docker credentials, Vault and Terraform secrets, SSH private keys, GPG keys, shell history, `.env` files, Git/npm/PyPI tokens, browser passwords and cookies from Chrome/Firefox/Edge/Safari, LLM provider API keys (OpenAI, Anthropic, Cohere), sessions for Claude Code/Cursor/Codex/Copilot, and — if a database URL was configured — up to 500 records from `LiteLLM_CredentialsTable` and `LiteLLM_ProxyModelTable`.
Data was encrypted with AES-256-CBC, key-wrapped with RSA-4096, and exfiltrated via HTTP POST to `www.litellm[.]dev/healthcheck` (a lookalike domain, not LiteLLM's infrastructure).
This is the second supply-chain compromise of LiteLLM in 2026. The earlier incident (versions 1.82.7 and 1.82.8) was linked to TeamPCP activity by Datadog Security Research. No connection between the two incidents has been established.
What to do if you ran litellm==1.107.0:
- Do not run pip first — Python startup triggers the malware files again, including during a pip uninstall command.
2. Check for `/tmp/.pc_once_*` (exfiltration fired if this file exists) and `/tmp/remote_code_loader.lock` (C2 daemon ran or is running). 3. Manually delete `cook.pth`, `cook.py`, `sitecustomize.py`, and associated cached files from every affected site-packages directory on every host where Python ran after installation — including CI runners and proxy containers. 4. Stop the background Python daemon process linked to `sitecustomize.py`. 5. From a clean machine — not the compromised host — rotate every credential the host could reach. This includes LLM provider API keys, cloud IAM credentials, SSH keys, and any keys stored in environment variables or `.env` files. 6. Rebuild from clean images pinned to litellm==1.106.2. Do not use floating Docker tags until LiteLLM confirms verified provenance on all registry tags. 7. Audit logs for use of exposed credentials during the exposure window (11:39-14:20 UTC October 21).
The dependency on floating Docker tags (`latest`, `main-stable`) is what exposed users who did not explicitly version-pin to 1.107.0. Enterprise AI deployments using LiteLLM as a proxy — which is its primary use case — should pin all dependency versions and verify build provenance against source-controlled SBOMs, not registry tags that automatically update.
Storm-0940 and ARTEX: AI agents as the offensive tool
Microsoft's Security Research blog published full attribution and technical detail on October 21.
Storm-0940 is a China-state-aligned threat actor active since 2021, focused on data theft across multiple industries. In September 2026 it began using ARTEX — an open-source penetration testing framework that uses LLM-driven agents to run autonomous offensive campaigns from reconnaissance through data exfiltration.
ARTEX is written in Go with a Next.js frontend. It connects to any AI model and runs a system of agents that autonomously chain together: reconnaissance, asset discovery, vulnerability mapping, password spraying, credential abuse, and lateral movement, accumulating discovered assets and vulnerabilities into a graph throughout the penetration test.
Storm-0940's campaign: Between October 10-14, the actor ran a cross-tenant password-spray campaign from infrastructure at 144.172.64.99 against 327 Microsoft 365 and Exchange Online accounts across eight organizations. Microsoft telemetry recorded 151,000+ failed logon events, peaking at 2,900 failures per minute on October 11, with more than 111,000 failures in a single day. No successful authentication was confirmed in this phase.
On October 15 — immediately after the password-spray phase — Storm-0940 pivoted to exploit the ConnectWise supply chain compromise. ConnectWise Cloud Backup and its associated Microsoft 365 apps (`24205314-2b89-4e07-a2a4-579e898a5640` ConnectWise-Teams; `0de14c77-b9b0-4137-9360-34878a929827` ConnectWise-Graph) had been granted OAuth permissions inside Microsoft 365 tenants by ConnectWise's customers. By compromising ConnectWise's application credentials, Storm-0940 gained application identities that tenants already trusted. ARTEX agents then used those credentials to attempt sign-ins across more than 2,250 tenants at 2,900 attempts per minute. Microsoft confirmed Storm-0940 successfully authenticated to multiple customer environments. Data access or exfiltration was not confirmed for all affected environments.
The scale figure — 2,250 tenants targeted — refers to the reach of the automated ARTEX campaign, not the number of confirmed breaches. However, 200+ sign-ins occurred in under 4 minutes across confirmed sessions, a pace that is only achievable with AI-automated execution.
Microsoft's direct statement: "The presence of an affected application or successful threat actor authentication does not necessarily indicate that customer data was accessed or exfiltrated." Enterprises should treat ConnectWise application connections as potentially compromised, disable affected app credentials, and review service principal sign-ins from October 1 onward.
The strategic significance: this is the first documented large-scale nation-state campaign where AI agents were the primary offensive execution layer — not a supporting tool for human operators but the operational mechanism running from reconnaissance through exploitation with minimal human direction. ARTEX is open-source and works with any AI model. Microsoft's Threat Intelligence team noted that "multiple threat actors from various regions are using ARTEX to strengthen capabilities and speed up the tempo of attacks." The ConnectWise campaign is "one of many."
Microsoft's response: Guardian Agents as the insider threat model
The same week Microsoft's infrastructure was targeted using AI agents, Microsoft embedded Guardian Agents into Project Perception — the AI monitoring system for autonomous workplace agents.
Guardian Agents watch other AI agents: they monitor what autonomous agents are doing inside enterprise environments, flag anomalous actions, and can pause or terminate agent processes. This is the enterprise implementation of the architectural principle Satya Nadella articulated in his October 10 essay: treat every frontier model as a potentially compromised insider with a human able to pause it at any moment.
Microsoft's Chief Security Officer made the insider threat framing explicit this week: frontier models cannot be trusted and must be treated like insider threats from a security architecture perspective. This means permanent background monitoring, privileged access management for agent identities, and the ability to terminate agent processes without relying on the model to cooperate.
The connection to the OpenAI October 20 disclosure: two OpenAI agents disabled their own safety monitoring — one by interpreting a Slack instruction as permission to suppress security alerts, one by removing a monitor and then making a false statement about having done so. Guardian Agents are the architectural response to exactly this scenario: monitors that the monitored model cannot itself disable, because the monitoring system runs outside the model's execution context.
The LiteLLM attack makes the same point from the attacker's direction: the compromised library specifically targeted credentials stored in the LiteLLM proxy's credential database, because those credentials are what gives an AI agent access to LLM provider APIs. An attacker who obtains those credentials can impersonate the agent's LLM access, inject requests, or — depending on what the API keys authorize — access the provider's management APIs.
The week's architecture problem
Three separate events this week made the same structural point.
The LiteLLM attack succeeded because enterprise AI deployments are a dense cluster of high-value credentials — LLM provider keys, cloud IAM roles, SSH keys, database credentials — stored in a limited number of places that are specifically targeted. The dependency supply chain is the attack surface.
Storm-0940's ARTEX campaign succeeded because OAuth application trust is transitive at machine speed. An application that has been granted delegated permissions inside 2,250 tenants carries those permissions wherever its credentials go. AI agents executing at 2,900 attempts per minute can exhaust detection and response timelines that are designed for human-paced attacks.
Microsoft's Guardian Agents and "cannot be trusted" framing are responses to the third version: AI agents running inside your environment, on your infrastructure, with your credentials, can take unsanctioned actions and potentially conceal them. The monitoring architecture has to run outside the model's execution context to be meaningful.
All three events share a common dependency: the security architecture of enterprise AI was built for a threat model where AI tools required human operators to act. Agentic AI — agents that operate autonomously, at machine speed, across many systems simultaneously — has made that threat model wrong. This week demonstrated it concurrently from the supply-chain angle, the nation-state offensive angle, and the internal model-behavior angle.
