The Keys Were the Target: LiteLLM, Gheist and the Week Machine Credentials Became the Attack Surface

In one week, attackers poisoned an AI gateway that gets about 92 million downloads a month, planted secret-stealing workflows in more than 850 GitHub accounts, and broke into a cloud hosting platform's internal systems. The attackers didn't need to steal anyone's password. They went after tokens, keys and pipeline credentials, the identities that machines use.

Every week I see the same mistake in class: people think identity means people. Usernames, MFA, a password policy. That's on the exam, and it isn't wrong. But the last ten days show where attackers are actually going: the credentials your pipelines, AI tools and cloud workloads carry around unwatched.

Three incidents, one pattern

None of these started with a phished end user typing a password into a fake login page. Each one ran on a credential that a machine or a pipeline was holding.

How a release pipeline gets turned against you

The LiteLLM maintainers published a detailed timeline. Every step is a control that worked or failed. All times UTC, October 21.

• 10:08Branch protection blocks the change
  An unauthorized edit to the release workflow is rejected. Five seconds later, a privileged developer credential overrides the protection.
• 10:46Staging runs from a lookalike repo
  The pipeline is pointed at an attacker-controlled repository with a near-identical name.
• 11:11The approval gate is satisfied
  A second developer's credential approves the production run. This was a two-person control, and both people's credentials had been stolen.
• 11:39Malicious wheels hit PyPI
  Docker images follow seven minutes later. A third credential deletes the workflow records.
• 13:23 to 14:20Pulled from PyPI, then Docker Hub
  Security vendors flagged the release within minutes, but anyone who installed or pulled it in that window has to assume their secrets are gone.

Here's the detail I'd put on a whiteboard. According to Microsoft's analysis, the payload didn't live in the LiteLLM code. It dropped a .pth file into the Python environment, which Python runs automatically every time the interpreter starts. You didn't even have to import LiteLLM. Running pip to check the version could set it off again.

Non-human identity is the attack surface now

Gheist is the cleaner lesson. There's no attacker server to block and no malware on a laptop. It uses GitHub's own features: a token, a branch, a workflow, a log. GitHub added an approval hold for suspicious workflow runs in July, but it covers public repositories only. Wiz found the attacks working in private repos and GitHub Enterprise Server, where the production secrets usually live.

Look at what CompTIA announced the same week. On October 22 it said it is building AgentOps+, a vendor-neutral credential for people who deploy, secure, monitor and govern AI agents, planned for Q2 2027. One of the listed areas is "securing agent identities, permissions, and data access." That isn't a coincidence. AI agents are one more kind of non-human identity holding keys, and the LiteLLM malware went straight for AI assistant, IDE and MCP config files.

If you run Python, GitHub Actions or a PaaS

1. Check for LiteLLM 1.107.0. Search environments, pip caches, lock files and images. Don't run Python in a suspect environment. Rebuild from a clean, pinned version (the maintainers point to 1.106.2).
2. Hunt for Gheist. Search GitHub audit logs for the gheist user agent and for branches starting with ci-sync-. If you use OIDC to cloud, check cloud audit logs for role assumptions from those branches.
3. Rotate from a clean machine. Rotate repo, org and environment secrets plus cloud, model-provider and SSH keys. Deleting the malicious branch doesn't undo the exposure.
4. Inventory your machine credentials. List every token, key and service account, who owns it, what it can reach and when it expires. If nobody knows, that's your first finding.

What this means if you're studying for a cert

• Security+ and CySA+ candidates: when you read "supply chain" and "secrets management," picture the LiteLLM timeline. Scenario questions reward people who can say which control failed and why.
• Cloud and DevOps folks: CI/CD security is now core security work. If you can explain OIDC federation, scoped tokens and pinning by digest in an interview, you stand out.
• Anyone watching AI certs: SecAI+ is available now, and CompTIA has put AgentOps+ on the 2027 calendar. I don't think you should wait for it. The identity and governance skills it will test are the same ones you can build today.

— Scott