Google's Agent Development Kit Had an Unpinned LiteLLM Dependency During an Active Supply Chain Compromise

Google's Agent Development Kit for Python listed litellm>=1.75.5 as an optional dependency. No upper bound. No pin. During the week of March 24, LiteLLM versions 1.82.7 and 1.82.8 were compromised by the TeamPCP group with a three-stage payload: credential harvesting, Kubernetes lateral movement, and persistent backdoor for remote code execution.

Anyone who ran pip install google-adk[extensions] during that window could have pulled in the backdoored packages. LiteLLM gets 3 million daily PyPI downloads. Google's ADK is one of the most popular agent frameworks. The intersection of those two install bases is not small.

The payload was sophisticated. Stage one harvested credentials from environment variables and cloud metadata endpoints. Stage two performed lateral movement across Kubernetes clusters, a pattern suggesting the attackers specifically targeted cloud-native AI workloads where agent frameworks run. Stage three established persistent backdoor access for RCE. This wasn't a proof of concept. This was a production attack targeting the exact infrastructure that runs AI agents.

The root cause is embarrassingly simple: >=1.75.5 with no upper pin. This is dependency management 101. We solved this in web development years ago with lockfiles, pinned versions, and hash verification. But the AI middleware ecosystem is moving so fast that basic hygiene gets skipped. LiteLLM updates frequently, and pinning feels like friction. Until it doesn't.

This connects to a broader pattern I keep seeing: agent frameworks treat their dependency trees as trusted by default. They shouldn't. Every pip install of an agent framework pulls in dozens of packages, any one of which could be compromised. The attack surface isn't the agent itself. It's the supply chain underneath it.

If you're building with any agent framework, audit your dependency pins today. Run pip audit or safety check against your requirements. Check for any packages with unbounded version specifiers in your AI middleware stack. And if you ran pip install google-adk[extensions] between March 23-25, assume compromise and rotate all credentials in that environment.

Source: GitHub Issue #4986