---
title: Tip: a leaked key isn't dealt with until it's revoked, and no agent should hold a human owner's GitHub token | ctxsec
url: https://ctxsec.com/items/tip-agent-tokens-scoped-revoke-leaked-keys-now
description: ""
status: "tip based on LiteLLM's Oct 23 root-cause analysis"
published: 2026-10-25
---

> 

[← Tips & Guides](/tips) · [markdown](/items/tip-agent-tokens-scoped-revoke-leaked-keys-now.md)

tip based on LiteLLM's Oct 23 root-cause analysis

2026-10-25

### Tip: a leaked key isn't dealt with until it's revoked, and no agent should hold a human owner's GitHub token

- When a secret lands in a public commit, revoke it at the issuer first. Rewriting git history doesn't un-leak it; LiteLLM's key was exploited 136 days after it was "fixed" by force-push.
- List every credential your agent platforms, bots and CI hold. Replace personal or owner OAuth tokens with GitHub Apps or fine-grained tokens limited to the repos and permissions the agent needs.
- Keep release approval tied to something an attacker can't take from a token: a hardware-backed account or required reviewers who must re-authenticate. Don't relax it "temporarily".
- Alert on branch-protection overrides, deleted workflow runs, and new branches whose workflows send data to webhook.site-style endpoints. All of these showed up in LiteLLM's audit log.

Sources: [LiteLLM: The attack chain behind the v1.107.0 LiteLLM release (root-cause analysis, Oct 23)](https://docs.litellm.ai/blog/security-incident-oct-21-2026-attack-chain)