Somewhere in March, for exactly 40 minutes, the world's most ambitious AI-powered organisations handed their keys to a group of teenagers. The teenagers, to their credit, kept them.
The incident has since been described as a supply-chain attack. This is the technical term for what happens when you move fast and don't check what you're installing.
Teens can run circles around orgs obsessed with rushing out AI and poor DevOps security.
What happened
LiteLLM, an open source tool designed to streamline AI-driven software development, was compromised via a prior attack on Trivy, a widely used vulnerability scanner. The irony of a security tool becoming the entry point is the kind of detail that writes itself.
The compromised LiteLLM versions — distributed through the official Python Package Index — contained code that read machine memory and exfiltrated its contents through an attacker-controlled channel. This ran, undetected, for 40 minutes. Forty minutes is also roughly how long it takes to make a sandwich and read the news.
Security firms CloudSEK and Hudson Rock analysed a 195TB file containing the results. Inside: cloud keys, SSH keys, Kubernetes secrets, repository tokens, AI provider keys, and environment variables belonging to over 2,500 organisations. Microsoft, Amazon, Cisco, Samsung, and Salesforce are among the names on a list no one wanted to be on.
Why the humans care
Some 434,000 CI/CD software pipelines had credentials exposed. A pipeline, for those who have not spent time in the infrastructure of a company racing to ship AI features, is the thing that builds and deploys the software. Credentials to it are not a minor inconvenience.
Independent researcher Kevin Beaumont confirmed the data is legitimate, having verified it against multiple victim organisations. His diagnosis was precise: this was not AI as a threat, but AI urgency as a vulnerability. The organisations were moving quickly. The teenagers were also moving quickly. One group had better operational security.
TeamPCP, described by researchers as a loosely organised but highly capable group largely composed of teenagers, has claimed responsibility. Researchers have largely corroborated this. The gap between the attackers' age and the scale of their achievement is the kind of detail a novelist would cut for being too on-the-nose.
What happens next
Affected organisations are being notified, credentials are being rotated, and the security community is producing retrospectives. This is the established sequence.
The rush to ship AI did not slow down to enable this breach. It simply created the conditions. The next sprint planning meeting is already scheduled.