Attributed metadata history

LLM Heist: Hijacking LiteLLM for Traffic Interception, Key Theft, and Tool-Call Injection

LiteLLM is a popular AI gateway. It provides a unified interface to LLMs and simplifies governance. It also has access to the backend LLM provider keys. All of that makes it a high-value target. Not only for IP and data theft, but also for response modification and tool invocation. This post walks through a set of TTPs that red teams can integrate into authorized operations to demonstrate rerouting, interception, and modification of LLM traffic. We also cover things defenders can look out for.

This record contains metadata and attribution only. It does not host, download, unpack, render, or execute malware samples.