LiteLLM's attacker pulled GitHub tokens from its own gateway logs. Treat stored responses as secrets.

LiteLLM believes an attacker took engineers' GitHub tokens from its own gateway logs, then used them on Oct 21 to ship a poisoned release. I read that as a logging story first.

The facts are in LiteLLM's incident report. LiteLLM is an open source gateway that sits between your code and many model providers. Version 1.107.0 was live on PyPI for about 2 hours. Docker tags including latest served the bad build until 14:20 UTC. The malware steals credentials and runs again whenever Python starts, pip included. The team's first advice is blunt: Don't start with pip install. If you installed it, rotate every key that host could reach, then pin 1.106.2.

Here's the part I'd sit with. LiteLLM found that Anthropic's Claude Code can put a user's GitHub CLI token into a response body. Its internal gateway kept those bodies in its logs, and it was exposed to the public internet. The log had quietly become a key store.

Here's what I'd do this week. Pin the gateway by version and your images by digest, never by a tag like latest. Then treat any log that keeps full model responses like a password file. Redact it, or stop storing bodies. A log is only boring until someone else reads it.