In the wild
Realized harm
TeamPCP (UNC6780) compromised LiteLLM and other GitHub repos/Actions to plant the SANDCLOCK credential stealer
AIR-2026-0112 AIR record · 2026-05-teampcp-litellm-github-actions
A real party was affected. This incident caused actual consequences, not a demonstrated capability.
From the supporting source
The threat actor subsequently leveraged their access to these GitHub repositories to embed the SANDCLOCK credential stealer and extract high-value cloud secrets, such as AWS keys and GitHub tokens, directly from affected build environments.cloud.google.com
The record
Disclosed
2026-05-12
Vendor
BerriAI and others
Product
LiteLLM / BerriAI, Trivy, Checkmarx GitHub repositories and Actions
Risk domain
Tool misuse › Supply chain vulnerabilities
Also touches
Credential theft
System type
Generative model
Who acted
AI was the target — a GitHub Actions supply-chain compromise of an AI gateway repo
Attack surface
Agent framework
Autonomy level
Assistant
Initial vector
Github actions supply chain compromise
Impact type
Supply chain compromise, Credential theft
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI04 – Agentic Supply Chain Vulnerabilities
- MITRE ATLAS
- AML.T0040 – AI Supply Chain Compromise
- NIST AI RMF
- MAP 4.1
- EU AI Act
- Annex III §2
- ISO/IEC
- TR 24028; 42001; 23894
- AIUC-1
- B. Security
- Scope
- tool failure
- Mitigation
- Scan dependencies and container images for vulnerabilities; Use trusted sources.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
Downstream consumers of the compromised repositories and Actions; AWS keys and GitHub tokens extracted from build environments
Capability abused
Taxonomy & references
Curator notes
Notable because LiteLLM is an AI gateway that proxies multiple LLM providers - compromising it puts the attacker astride other organisations' model traffic and keys. GTIG explicitly calls out the expanding AI-platform attack surface. Oligo separately links TeamPCP to the ShadowRay 2.0 campaign; that Oligo URL was surfaced via archive index but not independently cited, so the quote is from the GTIG post.
Supporting sources
Cite as
Enkrypt AI. "TeamPCP (UNC6780) compromised LiteLLM and other GitHub repos/Actions to plant the SANDCLOCK credential stealer". AIR, AIR-2026-0112. https://agentincident.vercel.app/i/AIR-2026-0112/ (accessed 2026-10-19).