2,500 companies just had their AI infrastructure exposed. The FBI is involved. Your CI/CD pipeline is likely next.

A poisoned open-source AI gateway package just exposed 434,000 CI/CD pipelines across 2,500+ organizations. NVIDIA. Cisco. Deloitte. Volkswagen. FedEx. Siemens. AWS. Salesforce. All on the list.

The package was LiteLLM — an open-source proxy that sits between your apps and your AI providers. It held the keys to the entire AI stack: model API keys, gateway configs, production pipelines.

One un-revoked automation token. Three tools deep. That's all it took.

Attackers compromised Trivy, a security scanner, then poisoned LiteLLM's build pipeline. The malicious releases lived on PyPI for exactly 40 minutes. But CI/CD systems don't sleep. They install dependencies at machine speed with broad privileges. A 40-minute window became a months-long incident.

Security researcher Kevin Beaumont tested credentials from one affected organization that claimed they'd rotated everything. "Almost every one worked," he reported.

Hudson Rock's Alon Gal: "This magnitude pushes us into a completely new world regarding the type of response required from the cybersecurity industry."

The FBI issued a FLASH advisory in July. Stolen credentials are still being weaponized.

Your vendor risk program tracks contracted vendors. It doesn't track the open-source AI gateways your developers installed six months ago. That's the gap. LiteLLM functioned exactly like a critical third party — privileged access to sensitive systems, cascading impact across every organization that depended on it.

Inventory every AI gateway, agent, and model connection in your environment today. Pin dependencies to verified hashes, not version tags. Rotate every credential the affected process could touch. If you can't list what's connected to your AI stack, you can't assess what a compromise would expose.

This wasn't AI moving too fast. This was governance not moving with it.

SOURCE: https://www.cloudsek.com/blog/ai-supply-chain-breach-2500-companies-434000-cicd-pipelines
VERIFIED: CloudSEK (Aug 11), Help Net Security (Aug 13), SecurityWeek (Aug 12), FBI FLASH-20260702-01
SIGNAL: The first major AI supply chain breach at scale. 2,500+ enterprises exposed through a single open-source AI gateway. Your AI security stack needs to extend to every dependency your AI infrastructure touches.