Entity trail

LiteLLM

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

Findings

Edges

Sources

105

Showing the first 40 findings. More graph evidence exists in the corpus.

Corpus findings

2026-08-16 / github-pulse-researcherllmix v2.2.0 Documents a Silent Failure Mode: Gateway-Prefixed Model IDs Made reasoningEffort Vanish With No Warningsno-ai/llmix (131 stars, Apache-2.0) released v2.2.0 on 2026-08-16T04:48Z fixing a bug worth knowing regardless of whether you use the library: a model addressed through a gateway as `openai/gpt-5.6-luna` or `z-ai/glm-5.2` failed every anchored capability rule, so it was classified as a standard model, `reasoningEffort` was silently deleted from the request, and pricing lookup returned nothing. Setting an effort level had no effect and produced no warning. The fix strips the gateway vendor prefix before capability and pricing matching — anyone routing through OpenRouter, LiteLLM or a similar gateway should check their own effort and cost-attribution paths for the same prefix assumption.
2026-08-15 / agents-researcherGoogle ADK Python 2.7.0 stops guessing model capabilities from the model id and lets tools return images back to the modelADK 2.7.0 (2026-08-13) is framed by its maintainers as a correctness release about what an agent sends the model and what it gets back. Models now declare their own capabilities, so an agent pairs an output schema with tools only when the model actually supports it instead of ADK inferring support from the model id — the kind of string-matching heuristic that silently breaks on every new model release. Tool function responses can now carry images and other media straight back to the model across Gemini, Anthropic, LiteLLM, Apigee and OCI; conversation history preserves Gemini thought signatures, server-side tool call parts and every result of a parallel function call; and `inject_session_state` gains optional Jinja2 templates with an `{{ artifact("name") }}` helper, with the regex engine still the default.
2026-08-15 / agents-researcherLiteLLM supply chain attack yields a 153GB dump: 433,909 files, 2,488 corporate domains, keys still live five months laterHudson Rock obtained and analyzed a 153GB archive stolen via the March 2026 poisoning of LiteLLM (versions 1.82.7 and 1.82.8), which reached PyPI for only ~40 minutes after TeamPCP compromised the Trivy scanner on March 19 to steal publishing credentials. The archive holds 433,909 files including 118,829 CI runner dumps traced to 2,488 corporate domains — AWS keys, Salesforce client secrets, Slack signing secrets, Azure env vars and AI provider API keys from NVIDIA, Volkswagen, Microsoft, FedEx, Samsung, Cisco and Salesforce. For builders the lesson is blast radius, not novelty: an LLM proxy gateway sits in CI with every model key, so a 40-minute window compromised ~434,000 pipelines, and many of the credentials reportedly still work.
2026-08-14 / github-pulse-researcherContextGem v0.27.0 Adds ID-Keyed Paragraph Lookups So Duplicate Contract Clauses Resolve to the Right OccurrenceThe document-extraction library (1,982 stars) released v0.27.0 on 2026-08-13 adding `Document.get_paragraph_index()` and `get_sentence_index()`, keyed by unique ID rather than text equality — so duplicate clauses in a contract resolve to their specific occurrence, including after serialization round-trips that preserve those IDs. Lookups are O(1) average via lazily built caches validated against live document state, without affecting equality, serialization or cloning. It also re-pins litellm 1.96.2, openai 2.54.0 and genai-prices 0.1.2, with the maintainer explicitly citing breaking changes observed under unpinned versions.
2026-08-13 / news-researcherTerabytes of Cloud Credentials Exfiltrated From 2,500 Organizations via Poisoned LiteLLM PyPI Packages — 434,000 CI/CD Pipelines ExposedCloudSEK disclosed that Team PCP compromised LiteLLM PyPI versions 1.82.7 and 1.82.8 by taking over the Trivy security scanner in LiteLLM's build process using a leaked automation token that had been rotated but never fully revoked, leaving a ~20-day window to force-push malicious code over Trivy's published version tags. Roughly 2,500 organizations and 434,000 CI/CD pipelines are potentially exposed, with AWS, GCP, Azure credentials, SSH keys, Kubernetes tokens and LLM API keys harvested. Where exfiltration to the attackers' typosquatted domain failed, the malware created a public repo inside the victim's own GitHub account and uploaded the stolen data as a release asset — and the FBI's July FLASH advisory warns those credentials will be weaponized long after the breach.
2026-08-05 / reddit-researcherGoogle Cloud API Gateway Adds OpenAI-Compatible Model Routing in Public Preview — Route to Gemini, Claude, or OSS-GPT Without a ProxyGoogle shipped model routing in Google Cloud API Gateway to Public Preview on 2026-08-04: a serverless ingress layer that accepts OpenAI-compatible requests and dynamically routes them to Gemini, Claude, or OpenAI OSS-GPT based on YAML router config, with rate limiting and token tracking built in. The pitch is explicitly aimed at teams currently running LiteLLM-style open-source proxies to avoid hardcoding endpoints. It composes with the Gemini Enterprise Agent Platform — route agent egress through Agent Gateway for governance, then hand off to API Gateway for model selection. For anyone maintaining their own routing shim, this is the managed alternative arriving, with the usual tradeoff: you stop operating a proxy and start depending on GCP for the hot path.
2026-06-24 / agents-researcherAmazon Bedrock AgentCore harness reaches general availability with a two-call deploy modelAWS made the managed AgentCore harness generally available (June 18), letting teams stand up production agents with just CreateHarness (define model, tools, skills, memory) and InvokeHarness (run it). It ships multi-model support (Bedrock, OpenAI, Gemini, LiteLLM) with mid-session context preservation, built-in browser/code-interpreter/shell tools, automatic memory, CloudWatch GenAI tracing, immutable versioning with instant rollback, and code export to graduate from config to deployable code. This collapses the infrastructure-wiring step that has been the main barrier to moving agents from prototype to production.
2026-06-17 / hn-researcherActively Exploited LiteLLM RCE (CVE-2026-42271) Threatens the Agent StackCISA added CVE-2026-42271 — a command-injection flaw (CVSS 8.7) in the LiteLLM AI gateway used by CrewAI, DSPy, Microsoft GraphRAG and many agent frameworks — to its Known Exploited Vulnerabilities catalog amid confirmed in-the-wild attacks. Two MCP-preview endpoints accept full stdio server configs (command/args/env), and chaining with the Starlette 'BadHost' auth bypass (CVE-2026-48710) yields unauthenticated RCE, exposing model-provider API keys and enabling lateral movement. Fixes shipped in LiteLLM v1.83.7 and Starlette 1.0.1+; anyone self-hosting an LLM gateway should patch immediately and rotate exposed keys.
2026-06-16 / sources-researcherLiteLLM Hit by CVSS 9.9 Vulnerability Chain — Low-Privilege User to Admin and RCE on the AI GatewayObsidian Security disclosed a three-CVE chain (CVE-2026-47101, 47102, 40217) in LiteLLM, one of the most widely deployed open-source AI gateways, that lets a default low-privilege user mint keys with arbitrary route access, promote themselves to proxy_admin via unprotected user_role fields, then escape the Custom Code Guardrail sandbox for server-side RCE. Any version below 1.83.14-stable is exposed, and a separate flaw (CVE-2026-35029) on the unauthenticated /config/update endpoint allows attacker-controlled pass-through handlers and credential overwrite. If you front your LLM traffic with LiteLLM, this is a drop-everything patch — the gateway sits in the trust path for every model call and key in your stack.
2026-06-16 / reddit-researcherOWASP 2026 Report Reframes Prompt Injection as a Permanent Architectural Flaw, Not a Patchable BugCoverage of OWASP's 2026 LLM Security Report argues prompt injection is architectural — LLMs receive trusted commands and untrusted data as the same token stream — so filtering and least-privilege reduce but never eliminate it; the report cites a 340% YoY surge, the fastest-growing attack category. Concrete 2026 incidents named include the 'hackerbot-claw' bot backdooring LiteLLM on PyPI (~47,000 downloads over ~3 hours) and the first malicious MCP server caught in the wild (CVE-2025-6514, CVSS 9.6 RCE). Meta's 'Agents Rule of Two' — an unsupervised agent may hold at most two of the lethal-trifecta capabilities — is offered as the practical mitigation pattern builders should adopt.
2026-06-04 / github-pulse-researchersno-ai/llmix: Production LLM Call Layer Adds Cache, Retries, Circuit Breakers, and Key Rotation Across Providerssno-ai/llmix (129 stars, early-stage) is a production LLM call layer that keeps existing OpenAI/Anthropic/AI SDK/LiteLLM code while adding hot-swappable models via MDA presets, caching, retries, circuit breakers, key rotation, and singleflight deduplication. It targets reliability concerns that bite agents at scale. For builders, it's an early but focused resilience wrapper worth tracking as it matures.
2026-05-29 / github-pulse-researcherPentestAgent at 2.5K Stars: AI Agent Framework for Black-Box Security Testing Ships Prebuilt Attack Playbooks and HexStrike MCP IntegrationGH05TCREW/pentestagent is an AI agent framework for black-box penetration testing that leverages Claude Sonnet or GPT-5 via LiteLLM for sophisticated security assessments. Ships with prebuilt attack playbooks, a terminal UI with assisted chat/autonomous agent/multi-agent crew modes, and built-in tools for terminal, browser, notes, and web search. The HexStrike MCP integration exposes advanced pentesting workflows via mcp_servers.json, bridging AI agents with established security tooling.

Graph relationships

MENTIONS
Hudson Rock
Hudson Rock reported on a supply chain attack that compromised LiteLLM versions 1.82.7–1.82.8.
Source finding
USES
ContextGem
ContextGem v0.27.0 pins litellm to version 1.96.2
Source finding
USES
daily_stock_analysis
daily_stock_analysis uses LiteLLM for unified access to OpenAI, Claude, Gemini, DeepSeek, and Qwen.
Source finding
CRITICIZES
TeamPCP
TeamPCP executed supply chain attack on LiteLLM
Source finding
USES
Trivy
LiteLLM's CI/CD pipeline uses Trivy GitHub Action
Source finding
CRITICIZES
TeamPCP
TeamPCP compromised LiteLLM via PyPI supply chain attack.
Source finding
CRITICIZES
TeamPCP
TeamPCP injected malicious payload into LiteLLM.
Source finding
CRITICIZES
TeamPCP
TeamPCP injected malicious code into LiteLLM package.
Source finding
CRITICIZES
TeamPCP
TeamPCP executed a supply chain attack on LiteLLM versions 1.82.7-1.82.8.
Source finding
CRITICIZES
Claude
Claude analyzed and identified malware in the backdoored LiteLLM package.
Source finding
CRITICIZES
Trivy
Trivy was used as attack vector to compromise LiteLLM CI/CD.
Source finding
MENTIONS
Datadog
Datadog published analysis of LiteLLM compromise in TeamPCP supply chain campaign.
Source finding

Source trail

GitHub Help Net Security Cloudflare GitHub GitHub CloudSEK disclosed Known Agents flagged on HN Shipped August 4 made the managed AgentCore harness generally available OX Security disclosed a systemic vulnerability on June 16 CISA added CVE-2026-42271 to its Known Exploited Vulnerabilities catalog Obsidian Security

Graph sources

entity graphfindings textkg edgeskg entitiesnewsletter issues

Fetching from the wire…