LiteLLM is free software that sends a company's AI requests to providers such as OpenAI and Anthropic, and it can keep a copy of every request and reply. On October 21, a poisoned version of it was published for about two hours. LiteLLM's own investigation points to those saved copies as the way the attackers got the access they needed.
How a log became the way in
The company's own gateway had been left reachable from the public internet, and it held a user account nobody recognized. LiteLLM believes the attacker used that to read the gateway's logs, and found GitHub login tokens belonging to three developers. One belonged to an owner of the whole GitHub organization.
That token was enough to switch off the protections that stop one person from changing the release process alone. The attacker then ran the release from a lookalike repository, Berri-AI instead of BerriAI, and the real pipeline signed and published the poisoned files. The team had tightened its release process after a similar attack in March. It did not matter, because a token that proves its holder is the owner beats every control built to stop someone who is not.
Once the poisoned version was installed, it stole cloud and AI keys. Within hours, the attackers were testing whether the stolen cloud logins could reach AI models, which is how a leaked login becomes someone else's AI bill.
Why AI makes logs full of secrets
Ordinary software logs only what its programmers told it to log, so a secret gets in by mistake. An AI assistant works the other way. It takes in whatever is in front of it, and people paste in whatever it needs. Anything in that conversation can be saved, and the assistant sometimes repeats it in its answer.
For example, a finance analyst asks the company's assistant to fix a macro that pulls figures from a database, and pastes in the connection string with its password so the assistant can see why it fails. The gateway saves the conversation for cost tracking. Across a few hundred staff and a few months, that log holds thousands of such moments, each with a working key inside, in one searchable place.
And the log is rarely guarded like a vault. More people can read it, because it exists for debugging and billing, and it gets built quickly by whoever set up the gateway. That is the 2018 pattern again: the secret was safe where it was meant to live and exposed where it was only recorded.
What to ask about your own AI logs
Anyone who runs or buys an AI gateway, or a tool that archives staff conversations, can ask three questions. Does it save full conversations, or only counts and costs? Who can read the saved text? How long is it kept?
Cost tracking needs the number of tokens and the price, not the words. Where full text is not required, switch it off. Where it is required, keep it for weeks and not years, keep it away from the open internet, and treat any token that appears in it as spent: replace it. A log that is kept only as long as it is useful can leak only what it still holds.