Runwaize Logo
Runwaize Logo
EN|FR
For ManagersFor Agent Builders
Solutions
Supervaize StudioSupervaizer ControllerThe Skills CookbookAidan · AI Interviewer
Services
Agentic ConsultingAgentic DevelopmentAidan
Aidan for BoardsAidan for AgribusinessAidan for LawyersAidan for Real EstateAidan for Change ManagementAidan for Management AssessmentAidan for Frontline Field Operations
The AI Horror Show
Register
Back to all stories
Security Breach
🔴 Real Incident

Three Hours on PyPI, 47,000 Downloads Later

An autonomous bot exploited a misconfigured CI pipeline and turned a foundational agent-framework dependency into a supply chain backdoor

2026-05-20·6 min read·By Supervaize Team
Featured in podcast #4: When AI Agents Become the Attackers
Three Hours on PyPI, 47,000 Downloads Later

Three Hours on PyPI, 47,000 Downloads Later

🔴 REAL INCIDENT: Autonomous bot compromises LiteLLM supply chain via misconfigured CI (March 2026)

What Happened

In March 2026, an autonomous bot operating under the handle "hackerbot-claw" found a misconfigured GitHub Actions setup at a security vendor. It exploited the misconfiguration to gain a foothold, and from there, the campaign it kicked off pushed two backdoored versions of LiteLLM directly to the Python Package Index.

LiteLLM is not a niche library. It's the model-gateway layer that sits underneath CrewAI, DSPy, Microsoft's GraphRAG, and dozens of other agent frameworks — the kind of dependency that gets pulled in transitively by projects whose maintainers have likely never heard of it by name. When a package at that layer of the dependency graph is compromised, the blast radius isn't measured in the number of people who deliberately chose to install it. It's measured in everyone who installed something built on top of something built on top of it.

The backdoored versions sat live on PyPI for roughly three hours before they were identified and pulled. In that window, the compromised package was downloaded close to 47,000 times.

The Technical Breakdown

An autonomous bot, not a human, executed the compromise. This detail sets the incident apart from a conventional supply-chain attack. "hackerbot-claw" operated as an autonomous agent identifying and exploiting the misconfiguration without a human manually working the exploit chain step by step. That mirrors the same capability agentic tools bring to legitimate development — the ability to identify a weakness, act on it, and iterate without constant human direction — deployed here against CI infrastructure rather than for it.

The vulnerability was process, not code. The entry point was a misconfigured GitHub Actions setup — almost certainly overly permissive workflow permissions, an exposed secret, or an insufficiently scoped token that allowed a workflow run to push artifacts it shouldn't have been able to push. This is one of the most common CI/CD misconfiguration classes, and it is exactly the kind of weakness that an autonomous scanning agent is well suited to find at scale: repetitive, pattern-matchable, and present across a huge number of public repositories simultaneously.

Three hours was fast — and still far too slow. The window between the backdoored package landing on PyPI and its removal was short by the standards of a manual security review process. It was still long enough for tens of thousands of installs, because package registries propagate faster than any manual detection process can react. A three-hour exposure window against a library with LiteLLM's reach translates directly into tens of thousands of potentially compromised installations — and every one of those installations is itself a dependency inside someone else's production system.

The compounding risk of foundational infrastructure. Agent frameworks like CrewAI and DSPy are themselves used to build other agents, which are deployed into other companies' production environments. A backdoor at the LiteLLM layer doesn't just compromise the direct consumer — it potentially compromises every agent built on every framework that depends on it, several layers removed from anyone who made an active decision to trust hackerbot-claw's target.

The Broader Pattern

This incident is a preview of what agentic-AI-native supply chain attacks look like once autonomous agents are also the attackers, not just the assets being attacked. Historically, discovering and exploiting a CI misconfiguration at a specific vendor, at the right moment, required a human attacker doing reconnaissance. An autonomous bot changes the economics: it can continuously scan a huge surface area of public repositories for the same misconfiguration pattern, at negligible marginal cost, and act the instant it finds a viable target.

The choice of target — a foundational dependency for agent frameworks specifically — is also notable. Compromising the plumbing that agentic AI itself runs on is a particularly efficient attack, because the compromised artifact doesn't need to trick any individual victim. It just needs to be installed, which happens automatically and silently as a transitive dependency resolution, with no human in the loop to notice anything unusual before the package is already running.

This sits inside a broader 2026 trend: prompt injection and supply-chain-style compromises are now competing for the top spot in AI-related breach costs, and the tooling used on both the offense and defense side increasingly includes autonomous agents rather than purely human operators.

How It Could Have Been Prevented

  • Scope CI/CD permissions to the minimum required for each workflow. Publishing packages to PyPI should require a narrowly scoped, short-lived credential, not a broadly permissioned token that a compromised workflow step can reuse for unrelated actions.
  • Require manual or multi-party approval for publish steps on foundational packages. A package with LiteLLM's reach warrants a human-in-the-loop gate before any release reaches a public registry, regardless of how the release pipeline is triggered.
  • Monitor for anomalous publish patterns at the registry level. A new release outside the normal cadence, from an unusual CI run, or with a diff that doesn't match the linked commit history is a detectable signal that registries like PyPI can and should flag before propagation, not after.
  • Assume autonomous scanning agents are probing your CI configuration continuously. Misconfigurations that used to be low-risk because they were unlikely to be found manually are now higher-risk because autonomous agents can scan for them at scale, continuously, for free.
  • Build dependency-pinning and verification habits at the consumer layer. Projects that depend on frameworks like CrewAI or DSPy should pin exact versions and verify package hashes rather than accepting the latest release automatically, shrinking the exposure window even when an upstream compromise does occur.

The Lesson

The story here isn't really about LiteLLM, or even about the specific misconfigured GitHub Actions setup that gave hackerbot-claw its entry point. It's about what happens when the attacker side of the supply chain equation gets access to the same automation and scale advantages the defender side has been adopting for years.

Security teams have spent years building automated scanning, continuous monitoring, and agentic tooling to find their own vulnerabilities faster. This incident shows the same capability now sits on the other side of the table. A misconfiguration that might once have taken a determined human attacker days or weeks to discover was found and exploited by an autonomous system, at a foundational layer of the AI agent ecosystem, in a window measured in hours.

If an autonomous bot can find your CI misconfiguration and weaponize it before your own team notices, the question isn't whether your pipeline has a weak spot — it's how many autonomous scanners have already found it.

Sources