2026’s Biggest AI Supply Chain Breach: LiteLLM Poisoning Leaks 195TB of Data, Affecting 2,500 Companies

In March 2026, the open-source AI API gateway LiteLLM suffered a supply chain poisoning attack. During an approximately 40-minute window, attackers exfiltrated around 195 terabytes of credential data through a compromised version, impacting roughly 2,500 companies worldwide. The leaked data included sensitive information such as cloud keys, code repository tokens, and SSH keys. Security firms CloudSEK and HudsonRock confirmed that the breach exposed credentials from approximately 434,000 CI/CD software pipelines. Affected organizations include NVIDIA, Amazon Web Services, Samsung Electronics, Cisco Systems, and Siemens AG.