2038 Repositories, One Backdoored Scanner: Tracing the LiteLLM Credential Leak Into Enterprise Copilot
Original illustration created for Cyber Security Briefing.
From a scanner to an AI gateway
CloudSEK first published the mechanics of the compromise on August 11, 2026, identifying the two malicious PyPI releases, versions 1.82.7 and 1.82.8, and the 40-minute window they sat live before being pulled. AI Agent Engineering's August 23, 2026 writeup builds on that finding: it attributes the compromise of the LiteLLM Python library directly to the earlier attack on Aqua Security's Trivy scanner, and it adds detail CloudSEK's initial report did not — that the payload executed on every Python invocation without an explicit import, using what AI Agent Engineering calls a "stealth .pth file" technique, and that it exposed cloud keys and AI provider keys for organizations including NVIDIA, AWS, and Cisco.
Trivy is a security scanner. LiteLLM is an AI gateway. The attack chain ran from one into the other, and from there into whatever downstream AI workflow pulled LiteLLM as a dependency. That is the part practitioners scanning their own CI logs for a Trivy invocation are likely to miss.
Why network monitoring didn't catch it
AI Agent Engineering's August 23 analysis of the breach archive identifies a detail that explains why conventional defenses failed. Every stolen file in the dump carries a uniform 127.0.0.1 tag in its naming convention. That localhost signature confirms the SANDCLOCK stealer read credentials directly from live CI/CD runner memory, in-process, rather than sending them over the network to a remote collection point. Network-based exfiltration monitoring had nothing to see.
The same report argues that security tools like Trivy have to be treated as production-level dependencies going forward, with strict pinning to hashes and least-privilege permissions rather than the loose version-tag references most CI configs use by default.
Microsoft's three-stage guidance
Microsoft Security published formal guidance titled "Guidance for detecting, investigating, and defending against the Trivy supply chain compromise," mapping three controls to the points where the leak could have been caught. Stage one is prevention: pin GitHub Actions to full SHA-1 hashes rather than version tags, the control that would have stopped a backdoored Trivy release from being pulled in the first place. Stage two is detection: monitor CI runners for unauthorized git or curl calls to unknown IP addresses — though given the in-process, localhost-tagged theft AI Agent Engineering documented, this stage catches lateral movement after the fact rather than the initial credential read. Stage three is response: immediate rotation of every secret accessible to the compromised environment.
None of these three controls is new advice on its own. What the advisory establishes is that they have to work together, because the in-memory theft technique defeats stage-two network monitoring by itself.
A database entry, not a confirmed breach, claims a path into Copilot
The one document connecting this incident to enterprise Copilot exposure is TopAIThreats' incident database entry, published August 1, 2026, which tracks the case as CVE-2026-32021. It states that the compromise allowed attackers to move laterally from CI/CD pipelines into enterprise AI systems, and it specifically flags developers using VS Code extensions like GitHub Copilot and Cursor, where a compromised library such as LiteLLM can arrive as a transitive dependency during routine agentic workflows.
That claim rests on a single source, and it is a database entry rather than an incident report with named investigators. No second document in this reporting corroborates the Copilot-specific lateral-movement path. The mechanism it describes is plausible given everything documented upstream — Trivy to LiteLLM to whatever pulls LiteLLM in — but the specific claim that Copilot or Cursor users were exposed has not been independently confirmed here.
If that path holds up, the control layer that matters shifts away from the pipeline that built the package. A May 30 M365 FM Podcast session on securing Copilot with Entra ID describes what a last line of defense would look like at that layer: Data Loss Prevention policies that can block exfiltration even if an agent is running a compromised dependency, under a "Zero Trust for AI" model that requires continuous identity validation for every tool call an autonomous agent makes. A pinned Trivy hash and a rotated OIDC token protect the pipeline that built the package. They would do nothing for an agent that later imports it as a transitive dependency inside a developer's editor.
Not an isolated event
TeamPCP, tracked under the identifier UNC6780, is not a single-incident actor. Pluto Security's tracker, updated September 3, documents 37 incidents linked to the group's criminal ecosystem between July 2025 and May 2026, identifying SANDCLOCK as its primary tool for harvesting GitHub Actions credentials and OIDC tokens from runner memory. The tracker names "tag hijacking" and trojanized native extensions — files with the .abi3.so suffix — as the group's signature techniques, chosen because binary extensions evade source-only code review in Python environments.
A team reviewing a pull request that adds or updates a Python dependency is looking at source. A compiled .abi3.so extension bundled inside that package isn't something a human reviewer reads line by line before merging. The Trivy backdoor and the LiteLLM compromise both moved through that blind spot, and Pluto Security's count of 37 prior incidents suggests it is one TeamPCP has used repeatedly.
Links Verified at Time of Publish.
Sources
This article was reported from the following sources.
- LiteLLM Supply-Chain Findings Highlight External Dependencies in Drupal AI Workflows — Drupal AI / Staff Reporter, 2026-09-04
- LiteLLM and SANDCLOCK: The Scanner Was the Attack Path — AI Agent Engineering, 2026-08-23
- Guidance for detecting, investigating, and defending against the Trivy supply chain compromise — Microsoft Security, 2026-07-08
- Secure Microsoft Copilot with Entra ID and Zero Trust — M365 FM Podcast, 2026-05-30
- TeamPCP - The supply chain attack story so far — Pluto Security, 2026-09-03
- Real-world AI Threat Incident Database: LiteLLM PyPI Compromise — TopAIThreats, 2026-08-01
