Disclosed vulnerability
LLM Heist: hijacking a LiteLLM gateway for traffic interception, provider key theft and tool-call injection
AIR-2026-0179 AIR record · 2026-08-berriai-litellm-llm-heist
From the supporting source
Using nothing but legitimate LiteLLM management functionality, an attacker can reroute requests, observe resolved provider credentials, collect prompts and responses, and modify requests or responses, including tool calls.embracethered.com
The record
Disclosed
2026-08-03
Vendor
BerriAI
Product
LiteLLM proxy/gateway
Risk domain
Access control and permissions › Credential theft
Also touches
Data exfiltration channels, Supply chain vulnerabilities
System type
Generative model
Who acted
AI was the target — compromised admin credentials on the LLM gateway
Attack surface
Agent framework
Autonomy level
Assistant
Initial vector
Compromised admin credentials
Impact type
Credential theft, Data exfiltration, Tool call injection, Response tampering, Traffic interception
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI03 – Identity and Privilege Abuse
- MITRE ATLAS
- AML.T0012 – Valid Accounts
- NIST AI RMF
- MEASURE 2.7
- EU AI Act
- Article 13
- ISO/IEC
- TR 24028; 42001; 23894
- AIUC-1
- B. Security
- Scope
- tool failure
- Mitigation
- Use secure credential storage; Implement short-lived tokens.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
all inference traffic routed through a compromised LiteLLM gateway
Capability abused
Defense & remediation
Recorded defense
LiteLLM master key / proxy admin authentication
Guardrail kinds
Authentication
Guardrail outcome
Silent
Fix shipped
not stated; post describes post-compromise abuse of legitimate admin APIs
Taxonomy & references
Curator notes
Johann Rehberger. Post also references a March 2026 PyPI package compromise and an Obsidian Security privilege-escalation disclosure; those are separate leads not verified here. Also reported as: 'LLM Heist: hijacking LiteLLM for traffic interception, key theft and tool-call injection'.
Supporting sources
Cite as
Enkrypt AI. "LLM Heist: hijacking a LiteLLM gateway for traffic interception, provider key theft and tool-call injection". AIR, AIR-2026-0179. https://agentincident.vercel.app/i/AIR-2026-0179/ (accessed 2026-10-19).