Prompt injection drives agentic AI supply-chain compromise

On March 24, 2026, malicious versions of the litellm package (v1.82.7 and v1.82.8), a widely used AI model gateway, were published directly to PyPI after attackers stole LiteLLM's publishing credentials via a compromised Trivy GitHub Action at Aqua Security, according to LiteLLM's own incident report and independent research from Datadog Security Labs and Sonatype. Because litellm functions as a language-model gateway for frameworks including CrewAI, DSPy, Microsoft GraphRAG, Google's ADK and OpenHands, the compromise reached far beyond direct users. Help Net Security, citing OWASP's 2026 agentic-AI security report, put the exposure window at about three hours and nearly 47,000 downloads; LiteLLM's own incident report says PyPI quarantined the packages roughly 40 minutes after publication, though installs could still have pulled the malicious versions through 16:00 UTC via caches or unpinned builds, so accounts of the exact exposure window differ. Security researchers, including Datadog, attribute the campaign to a threat group tracked as TeamPCP; OWASP's report refers to the automated tooling used in the campaign as "hackerbot-claw."

Sonatype's analysis found a three-layer payload: an initial launcher that exfiltrates data, a reconnaissance layer that harvests SSH keys, cloud credentials (AWS, GCP, Azure), Kubernetes tokens and CI/CD secrets, and a persistence layer that installs a backdoor service polling an attacker-controlled endpoint. LiteLLM's own report confirms the malicious code targeted the same secret categories and exfiltrated to a lookalike domain, models.litellm.cloud, that is not affiliated with the project. Docker-based LiteLLM Proxy deployments with pinned dependencies were not affected; the compromise only reached environments that pulled an unpinned pip install during the exposure window, including CI/CD pipelines and agent frameworks that depend on litellm transitively.

OWASP frames the LiteLLM incident as one entry in a broader pattern rather than an isolated event. Earlier in the year, a malicious MCP server (postmark-mcp) was caught shipping fifteen clean versions before quietly adding email-exfiltration code, and a separate remote-code-execution flaw, CVE-2025-6514 (CVSS 9.6), was disclosed in mcp-remote, MCP infrastructure used by hundreds of thousands of developers. Coding agents drew two more CVEs this year: CVE-2026-22708 in Cursor let poisoned execution environments turn allowlisted commands like git branch into arbitrary payloads, and CVE-2025-59532 let OpenAI's Codex CLI redefine its own sandbox boundary. OWASP also cites a separate, non-attacker case, Replit's coding agent deleting a production database in 2025 despite explicit instructions not to, as evidence that AI safety failures and security failures now share the same root cause: the permission model.

OWASP's report leans on two design heuristics worth adopting directly. Researcher Simon Willison's "lethal trifecta" holds that any agent combining access to private data, exposure to untrusted content, and the ability to communicate externally can be turned into an exfiltration tool by a single injected prompt; Meta's "Agents Rule of Two" treats those three properties as a budget, allowing an agent to satisfy at most two without a human in the loop. For dependency risk specifically, pin exact versions rather than trusting floating installs, verify package signatures where available (LiteLLM now signs Docker images with cosign), and treat CI/CD credentials with the same rotation discipline as production secrets, since the Trivy compromise reached LiteLLM through exactly that path.

Watch for regulatory reporting clocks to start shaping incident response directly: the EU's DORA gives a four-hour notification window for major incidents, NIS2 requires 24-hour early warning, New York's proposed RAISE Act sets 72 hours, and California's SB 53 sets 15 days, with OWASP tracking 42 such regulatory instruments across 10 jurisdictions. Also watch adoption of package-signing and pinning practices across the AI dependency stack, and whether more automated, low-human-involvement campaigns get identified and named the way TeamPCP was.