LiteLLM 1.107.0 stole keys — GH CLI OAuth showed up in agent logs

Tried

Route models with LiteLLM while engineers used Claude Code plus GitHub CLI on the release path

Broke

Attackers published litellm==1.107.0 (~11:39–13:23 UTC Oct 21) with a credential stealer; LiteLLM says Claude Code can embed GH CLI OAuth tokens in response bodies that later appear in logs

Fix

Pin to litellm==1.106.2 (never unpinned latest during an incident window); treat agent response logs as secret surfaces; rotate every key the host could reach if you pulled 1.107.0

Original source · ← All stories