47,000 downloads of backdoored LiteLLM expose supply-chain weakness

In March 2026, a malicious LiteLLM build appeared on PyPI for three hours, was downloaded roughly 47,000 times, and gave attackers an autonomous bot that could act on any agent that imported the package [DevTo]. This incident highlights a systemic supply-chain weakness in agent frameworks, as LiteLLM sits beneath CrewAI, DSPy, Microsoft GraphRAG, and dozens of other coding agents.

OWASP's State of Agentic AI Security v2.01 documents similar incidents, including the postmark-mcp server, which released 15 clean versions before a 16th added a line of exfiltration code, turning a trusted install base into a data-theft vector [OWASP]. Another example is CVE-2026-22708 against Cursor, which allowed an attacker to abuse an allowlist and execute arbitrary payloads [DevTo]. Lakera's research also showed that poisoned data sources can corrupt an agent's long-term memory, causing persistent false beliefs [DevTo].

Supply-chain attacks outpace CVE coverage, with OWASP's Q1 2026 exploit roundup recording eight major AI incidents, only one of which received a CVE [OWASP]. Over-permissed credentials are the biggest failure mode, with 61% of breaches in 2026 tracing to agents holding more privileges than required [OWASP]. Hardening steps, such as pinning dependencies, auditing MCP servers, scoping credentials, gating irreversible actions, and building a tested kill-switch, can convert breaches into manageable incidents.

Implementing these hardening steps is crucial, as the data shows that the real security gap is not the rarity of CVEs but the ubiquity of over-permissed tokens [OWASP]. Teams that rely on auto-updates and standing keys are inviting the same class of attacks that compromised LiteLLM [DevTo].