LiteLLM's root-cause analysis of the malicious litellm 1.107.0 release (see News, Oct 21) traces it to an agent system, not the package code. The LiteLLM Agent Platform, an experimental internal service that let self-hosted cloud agents open pull requests, was set up with a GitHub CLI OAuth token belonging to an organization owner. It was not a scoped service account.

• The leak: on May 27 an opencode.json containing the platform's master key was pushed to a public repo. The commit was force-pushed away and the key marked for revocation, but it was never revoked.
• The pivot: on Oct 10 one API call with that key (GET /api/v1/managed_agents/agents) returned every agent's config, including the owner's token. LiteLLM notes GitHub CLI tokens are issued after 2FA and skip GitHub's re-authentication prompt for sensitive org actions.
• From there: throwaway CI branches posted maintainers' tokens to webhook.site. On Oct 21 the attacker overrode branch protection, built the release from a lookalike fork, approved it with a stolen maintainer token, and deleted the logs.

The lesson for anyone running coding or PR agents: whatever credential an agent holds is exposed to everyone who can reach the agent's control API. Give agents their own narrowly scoped identity (a GitHub App or fine-grained token limited to specific repos), never a human owner's token, and treat the agent platform's admin key as being as sensitive as the strongest credential it stores.