---
title: How LiteLLM got backdoored: its internal agent platform held an organization owner's unscoped GitHub token, and a leaked platform key that was never revoked handed it to the attacker | ctxsec
url: https://ctxsec.com/items/litellm-agent-platform-master-key-owner-github-token
description: ""
status: "confirmed by the vendor (LiteLLM root-cause analysis, Oct 23); timeline backed by GitHub audit-log token hashes per LiteLLM"
published: 2026-10-25
---

> 

[← Context & Harness Attacks](/context) · [markdown](/items/litellm-agent-platform-master-key-owner-github-token.md)

confirmed by the vendor (LiteLLM root-cause analysis, Oct 23); timeline backed by GitHub audit-log token hashes per LiteLLM

2026-10-25

### How LiteLLM got backdoored: its internal agent platform held an organization owner's unscoped GitHub token, and a leaked platform key that was never revoked handed it to the attacker

LiteLLM's root-cause analysis of the malicious **litellm 1.107.0** release (see News, Oct 21) traces it to an agent system, not the package code. The **LiteLLM Agent Platform**, an experimental internal service that let self-hosted cloud agents open pull requests, was set up with a **GitHub CLI OAuth token belonging to an organization owner**. It was not a scoped service account.

- **The leak:** on May 27 an `opencode.json` containing the platform's master key was pushed to a public repo. The commit was force-pushed away and the key marked for revocation, but it was never revoked.
- **The pivot:** on Oct 10 one API call with that key (`GET /api/v1/managed_agents/agents`) returned every agent's config, including the owner's token. LiteLLM notes GitHub CLI tokens are issued after 2FA and skip GitHub's re-authentication prompt for sensitive org actions.
- **From there:** throwaway CI branches posted maintainers' tokens to webhook.site. On Oct 21 the attacker overrode branch protection, built the release from a lookalike fork, approved it with a stolen maintainer token, and deleted the logs.

The lesson for anyone running coding or PR agents: whatever credential an agent holds is exposed to everyone who can reach the agent's control API. Give agents their own narrowly scoped identity (a GitHub App or fine-grained token limited to specific repos), never a human owner's token, and treat the agent platform's admin key as being as sensitive as the strongest credential it stores.

Sources: [LiteLLM: The attack chain behind the v1.107.0 LiteLLM release (root-cause analysis, Oct 23)](https://docs.litellm.ai/blog/security-incident-oct-21-2026-attack-chain) · [Microsoft Security Blog: Inside the LiteLLM 1.107.0 supply chain compromise (Oct 23)](https://www.microsoft.com/en-us/security/blog/2026/10/23/inside-the-litellm-1-107-0-supply-chain-compromise-credential-theft-through-python-startup-hooks/)