.avif){kind=icon}
🚀 A CloudSEK se torna a primeira empresa de segurança cibernética de origem indiana a receber investimentos da
Leia mais
Voltar
Inteligência do adversário
2,500+ Companies and 434,000 CI/CD Pipelines Exposed in the Largest AI Supply Chain Breach of 2026
CloudSEK’s latest research examines the LiteLLM AI supply-chain attack, which potentially exposed 2,500+ organisations and 434,000 CI/CD pipelines worldwide. The report details the risks to cloud credentials, source-code repositories, Kubernetes environments and AI infrastructure, while highlighting how compromised AI dependencies can create enterprise-wide security exposure.
August 11, 2026
5
min
Tabela de conteúdo
Inscreva-se nos recursos do CloudSEK
Receba as últimas notícias, ameaças e recursos do setor.
Executive Summary
In March 2026, the threat actor group Team PCP orchestrated what is believed to be the largest supply chain attack targeting AI infrastructure by compromising LiteLLM. CloudSEK Threat Intelligence was able to get access to the victim information and is disclosing the details of all the impacted victims .
We are sharing this openly so that every affected organization can act proactively The threat is still live: the FBI's July 2026 FLASH advisory (FLASH-20260702-01) warns that affiliated actors are likely to weaponize the harvested credentials long after the original intrusion, which means further supply chain attacks remain a real possibility. Early awareness is the strongest defense; knowing you were impacted lets you rotate credentials, close the exposure, and harden before the next campaign hits.
Attacks on AI infrastructure are on the rise and that is exactly what CloudSEK AIvigil, our AI Attack Surface Monitoring platform, is built to prevent. AIvigil continuously discovers, monitors, and secures exposed AI infrastructure, MCP servers, leaked AI credentials, vector databases, agentic workflows, and shadow AI. We combine the power of cyber threat intelligence and AI exposure to detect and prevent cyberattacks on AI infrastructure.
Those exposed range from large AI companies and model providers to cybersecurity vendors, SaaS platforms, and enterprises worldwide.
Check if your organization is exposed in this AI Supply Chain Breach : https://exposure.cloudsek.com/ai-supply-chain-incident
VICTIM EXPOSURE DATA
Selected High-Confidence Organizations in the Exposure Dataset
The records below are the leading organization-level matches supplied for this report. High confidence refers to the strength of the exposure match,not proof of successful compromise or attacker use.
“Secrets” and “Runs” are reproduced as aggregate counts from the supplied dataset. Domains are shown only where provided. No secret values, credentials, internal paths, or personal information are included.
Selected High-Confidence Organizations — continued
Selected High-Confidence Organizations , continued
DATA AT RISK
What matters for victims
- The stolen object was Cloud keys, repository tokens, SSH keys, Kubernetes secrets, package publishing credentials, environment variables, and AI provider keys could allow attackers to move far beyond the affected package.
- Removal does not end the incident. A package can disappear in minutes while copied credentials remain usable for weeks or months unless they are rotated and downstream activity is investigated.
- Automated pipelines amplify a brief compromise. CI/CD systems install dependencies at machine speed and often run with broad privileges, making a short publication window operationally significant.
- AI infrastructure is becoming a strategic target. Gateways, agents, vector stores, model endpoints, and MCP servers sit between sensitive data and systems capable of taking action.
- Actor context is secondary. Public reporting attributes the campaign to Team PCP; this report limits actor discussion to what defenders need for attribution and response.
The Scale of Exposure
What was taken
On every compromised CI runner, TeamPCP's stealer (tracked by Google as SANDCLOCK) escalated to root and swept:
- SSH keys
- AWS, GCP, and Azure credentials
- Kubernetes tokens
- .env files and CI/CD secrets — including the values GitHub Actions tries to mask, scraped directly from /proc/<pid>/mem
- For AI builds specifically: LLM API keys and gateway configuration — the credentials to an organization's entire AI stack
Cloud keys were read straight from the instance metadata service (IMDS) and Kubernetes tokens from mounted service-account paths , no exploit needed, just the access each runner already carried. The collected data was then sealed with AES-256 under a hard-coded RSA-4096 key, so even intercepted traffic stayed unreadable without the actor's private key
The loot was encrypted and shipped to a typosquatted domain. Where exfiltration failed, the malware created a public repository inside the victim's own GitHub account and uploaded the stolen data there as a release asset , meaning some organizations were leaking their own secrets into public view without knowing it
VICTIM EXPOSURE
The Exposure: Organizations, Pipelines, and Downstream Systems
How exposure can become business impact
What victim-level disclosure should contain
What Was at Risk Inside the Exposed Environments
The value of the breach lies in what the affected process could read, not merely in the package name.
LiteLLM commonly operates close to model providers, application services, and deployment systems. In CI/CD and developer environments, the same host may also hold credentials for source control, cloud infrastructure, registries, containers, and production services. The categories below are potential exposure classes when present on an affected system.
ATTACK PATH
From a Trusted Package to Enterprise Access
The March incident illustrates how an AI component can become an entry point into the wider software and cloud estate.
AI INFRASTRUCTURE RISK
Why the Next Supply Chain Wave Will Target AI Infrastructure
CloudSEK assessment: AI systems are becoming high-value junctions between data, identity, compute, and autonomous action.
Privileged position. AI gateways and agent runtimes often hold credentials for models, databases, plugins, cloud services, and internal tools.
Wide dependency graph. Modern AI stacks combine open-source packages, hosted models, SDKs, extensions, connectors, vector databases, and third parties.
Autonomous execution. Agentic workflows can read, write, call tools, and trigger business processes, increasing the blast radius of stolen access.
Rapid and shadow adoption. Teams deploy AI services faster than central security inventories are updated, leaving unknown assets and unmanaged credentials.
High-value data. Prompts, retrieval stores, training data, model outputs, and connected business systems concentrate sensitive information.
Traditional visibility gaps. Conventional attack surface tools see endpoints and ports but often miss model, agent, MCP, prompt, and AI workflow context.
VICTIM RESPONSE
Immediate Actions for Potentially Exposed Organizations
Response should assume credential exposure first, then use evidence to reduce the scope.
Investigation questions that determine real victim impact
- Was an affected artifact downloaded, cached, executed, or merely referenced?
- Which secrets were present in environment variables, process memory, files, metadata services, or injected job contexts?
- Did any token show use from an unusual IP, device, geography, runner, or user agent after the exposure window?
- Could stolen publishing credentials have created a second-generation supply chain compromise?
- Did the affected AI gateway connect to sensitive prompts, vector stores, agents, internal tools, or customer data?
CLOUDSEK AIVIGIL
From Incident Response to Continuous AI Exposure Management
CloudSEK AIVigil is built to discover and monitor the AI attack surface and supply chain attacks before exposed infrastructure becomes an attack path.
AIVigil continuously discovers, monitors, and secures exposed AI infrastructure, MCP servers, leaked AI credentials, vector databases, agentic workflows, and shadow AI. It combines CloudSEK's cyber threat intelligence with AI exposure monitoring so security teams can connect an external signal to the AI asset, credential, dependency, and business system at risk.
The continuous loop
METHODOLOGY AND SCOPE
Methodology, Confidence, and Responsible Interpretation
Strong disclosure separates observed exposure, probable compromise, and confirmed malicious activity.
CloudSEK research inputs
- CloudSEK’s Threat Intelligence team obtained the exposure data through its intelligence sources, including records relating to organizations, CI/CD pipelines, and credential/token exposures associated with the March 2026 supply-chain cascade involving compromised Trivy, Checkmarx KICS, and LiteLLM builds
- The exposed AI and cloud assets those credentials reach , model endpoints, gateways, vector databases, GPU infrastructure, cloud accounts, and MCP/agentic workflows
- The three weaponized tool vectors that produced the exposure: Trivy, Checkmarx KICS, and LiteLLM
- Public advisories confirming the campaign and affected tooling: FBI FLASH, Aqua Security, Checkmarx, LiteLLM/BerriAI, Unit 42, and Sophos
Recommended confidence labels for the victim dataset
Attribution in one paragraph
Public reporting attributes the broader campaign to the financially motivated cluster Team PCP. The actor compromised trusted security and developer tooling and used credential-stealing payloads to reach cloud and CI/CD environments. The identity, internal disputes, forum affiliations, and leadership history of the group are not required to understand victim exposure and are intentionally excluded from the main narrative.
SOURCES AND CONCLUSION
CloudSEK AIVigil- AI Attack Surface Monitoring
Attacks on AI infrastructure are on the rise and that is exactly what CloudSEK AIvigil, our AI Attack Surface Monitoring platform, is built to prevent. AIvigil continuously discovers, monitors, and secures exposed AI infrastructure, MCP servers, leaked AI credentials, vector databases, agentic workflows, and shadow AI. We combine the power of cyber threat intelligence and AI exposure to detect and prevent cyberattacks on AI infrastructure.
Primary references
1. LiteLLM , Security Update: Suspected Supply Chain Incident (24 March 2026)
2. FBI , Cyber Criminal Group TeamPCP, FLASH-20260702-01 (2 July 2026)
3. Unit 42 , TeamPCP's Multi-Stage Supply Chain Attack on Security Infrastructure (31 March 2026)
4. Sophos , Vect and TeamPCP Partner for Ransomware Campaigns (2 July 2026)
5. CloudSEK , Introducing AIVigil: AI Attack Surface Monitoring
Inscreva-se nos recursos do CloudSEK
Receba as últimas notícias, ameaças e recursos do setor.
.png)
.jpg)
