LiteLLM was poisoned using GitHub tokens leaked from Claude Code, attacker says

Oct 26, 2026 · Issue 13 · 2 sources, 2 articles

LiteLLM says the attacker obtained the GitHub CLI OAuth tokens from its logs and used three stolen tokens to poison the project. A separate report describes new malware targeting AI coding tools that steals login tokens, SSH keys and cloud credentials.

Who is affected and how

senior developer

Use a CLI token only with narrow permissions and a short lifetime.

Narrative: The coding agent is the new attack surface

Sources

• LiteLLM attacker ‘obtained the GitHub CLI OAuth tokens from its logs’thenextweb.com · Oct 26, 2026
• New Malware Targets AI Coding Tools to Steal Login Tokens, SSH Keys, and Cloud Credentialsgbhackers news · Oct 26, 2026

Machine-generated summary based on the titles and excerpts of the source articles. The facts come from the linked article.