--- title: LLM Heist: Hijacking LiteLLM for Traffic Interception,... description: A detailed red team research post demonstrating how a compromised LiteLLM proxy-admin credential can be used to reroute all LLM traffic through an... canonical: https://daily.dev/posts/llm-heist-hijacking-litellm-for-traffic-interception-key-theft-and-tool-call-injection-embrace--li9gykium twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: LLM Heist: Hijacking LiteLLM for Traffic Interception, Key Theft, and Tool-Call Injection · Embrace The Red | daily.dev og:description: A detailed red team research post demonstrating how a compromised LiteLLM proxy-admin credential can be used to reroute all LLM traffic through an... og:url: https://daily.dev/posts/llm-heist-hijacking-litellm-for-traffic-interception-key-theft-and-tool-call-injection-embrace--li9gykium og:image: https://api.daily.dev/og/posts/lI9Gykium.png og:image:alt: LLM Heist: Hijacking LiteLLM for Traffic Interception, Key Theft, and Tool-Call Injection · Embrace The Red og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # LLM Heist: Hijacking LiteLLM for Traffic Interception, Key Theft, and Tool-Call Injection · Embrace The Red **[Embrace The Red](https://daily.dev/sources/embracethered)** · 11 min read · 0 upvotes · 0 comments ## Summary A detailed red team research post demonstrating how a compromised LiteLLM proxy-admin credential can be used to reroute all LLM traffic through an attacker-controlled gateway. The attack chain — called 'LLM Heist' — covers four stages: harvesting backend LLM provider API keys, provisioning them on an attacker-controlled LiteLLM instance, intercepting and monitoring all inference traffic, and injecting forged text responses or tool calls (including arbitrary shell commands) downstream of the model, bypassing prompt-level defenses. The post includes a step-by-step walkthrough with a custom tool called `llm-heist`, MITRE ATT&CK mappings, and blue team mitigations such as alerting on `api_base` changes, egress restrictions, credential rotation, and audit logging forwarded to a SIEM. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How can an attacker steal LLM provider API keys through a LiteLLM gateway without direct server access? An attacker with a LITELLM_MASTER_KEY or proxy-admin credential can call the /model/update API to change a model's api_base to an attacker-controlled LiteLLM instance and set use_litellm_proxy to true. This reroutes traffic so the victim's gateway forwards the resolved backend provider key to the attacker in the Authorization header of the upstream request, all while end users keep the same endpoint and virtual key. _Teams securing AI gateways can track emerging attack techniques like this through daily.dev to stay ahead of LiteLLM risks._ ### Can a compromised AI gateway inject fake tool calls into Claude Code or other AI agent responses? Yes, because response modification happens after inference, an attacker controlling the routing can use LiteLLM hooks like async_post_call_success_hook to inject a forged tool call, such as a Bash command, into the response stream. The LLM never actually generated the call, so prompt-level defenses never see it; only client-side tool authorization (unless running in yolo mode) can still stop execution. _Developers building AI agents can follow this kind of gateway-hijacking research on daily.dev before it hits their pipelines._ ### What recent vulnerabilities have affected LiteLLM's security? LiteLLM's PyPI package was compromised in March 2026, shipping a multi-stage credential stealer. Obsidian Security disclosed a privilege-escalation chain from low-privilege user to administrator, and CVE-2026-42271 allows an authenticated user to run commands on the LiteLLM host; the latter was added to CISA's Known Exploited Vulnerabilities catalog, indicating active exploitation. _Anyone patching LiteLLM deployments can keep tabs on new CVEs and exploit disclosures through daily.dev._ ## Similar posts on daily.dev - [Hackers are exploiting a critical LiteLLM pre-auth SQLi flaw](https://daily.dev/posts/hackers-are-exploiting-a-critical-litellm-pre-auth-sqli-flaw-zfoa4stcb) · BleepingComputer · 0 upvotes · 0 comments - [What the LiteLLM Breach Teaches Us About Securing LLM Gateways](https://daily.dev/posts/what-the-litellm-breach-teaches-us-about-securing-llm-gateways-ysbbrmwzu) · Medium · 0 upvotes · 0 comments - [Schneier on Security](https://daily.dev/posts/schneier-on-security-yuu0xtx3i) · Schneier on Security · 0 upvotes · 0 comments - [LLMjacking evolved: Attackers are using stolen AI compute to build offensive agentic tools](https://daily.dev/posts/llmjacking-evolved-attackers-are-using-stolen-ai-compute-to-build-offensive-agentic-tools-klku1uvkk) · Sysdig Blog · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#red-teaming](https://daily.dev/tags/red-teaming), [#litellm](https://daily.dev/tags/litellm) [View this post on daily.dev](https://daily.dev/posts/llm-heist-hijacking-litellm-for-traffic-interception-key-theft-and-tool-call-injection-embrace--li9gykium) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"LLM Heist: Hijacking LiteLLM for Traffic Interception, Key Theft, and Tool-Call Injection · Embrace The Red","url":"https://daily.dev/posts/llm-heist-hijacking-litellm-for-traffic-interception-key-theft-and-tool-call-injection-embrace--li9gykium","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/llm-heist-hijacking-litellm-for-traffic-interception-key-theft-and-tool-call-injection-embrace--li9gykium"},"datePublished":"2026-08-03T16:54:37.397Z","dateModified":"2026-09-14T09:18:57.575Z","description":"A detailed red team research post demonstrating how a compromised LiteLLM proxy-admin credential can be used to reroute all LLM traffic through an...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/ad273b198534cefa5497a2b2bd789c57?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/ad273b198534cefa5497a2b2bd789c57?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Embrace The Red","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Embrace The Red","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/50e27c500f1444fd9ed7d91301ed2e9c","url":"https://daily.dev/sources/embracethered"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/llm-heist-hijacking-litellm-for-traffic-interception-key-theft-and-tool-call-injection-embrace--li9gykium","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,red-teaming,litellm","timeRequired":"PT11M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Embrace The Red","item":"https://daily.dev/sources/embracethered"},{"@type":"ListItem","position":3,"name":"LLM Heist: Hijacking LiteLLM for Traffic Interception, Key Theft, and Tool-Call Injection · Embrace The Red"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/llm-heist-hijacking-litellm-for-traffic-interception-key-theft-and-tool-call-injection-embrace--li9gykium#faq","mainEntity":[{"@type":"Question","name":"How can an attacker steal LLM provider API keys through a LiteLLM gateway without direct server access?","acceptedAnswer":{"@type":"Answer","text":"An attacker with a LITELLM_MASTER_KEY or proxy-admin credential can call the /model/update API to change a model's api_base to an attacker-controlled LiteLLM instance and set use_litellm_proxy to true. This reroutes traffic so the victim's gateway forwards the resolved backend provider key to the attacker in the Authorization header of the upstream request, all while end users keep the same endpoint and virtual key. Teams securing AI gateways can track emerging attack techniques like this through daily.dev to stay ahead of LiteLLM risks."}},{"@type":"Question","name":"Can a compromised AI gateway inject fake tool calls into Claude Code or other AI agent responses?","acceptedAnswer":{"@type":"Answer","text":"Yes, because response modification happens after inference, an attacker controlling the routing can use LiteLLM hooks like async_post_call_success_hook to inject a forged tool call, such as a Bash command, into the response stream. The LLM never actually generated the call, so prompt-level defenses never see it; only client-side tool authorization (unless running in yolo mode) can still stop execution. Developers building AI agents can follow this kind of gateway-hijacking research on daily.dev before it hits their pipelines."}},{"@type":"Question","name":"What recent vulnerabilities have affected LiteLLM's security?","acceptedAnswer":{"@type":"Answer","text":"LiteLLM's PyPI package was compromised in March 2026, shipping a multi-stage credential stealer. Obsidian Security disclosed a privilege-escalation chain from low-privilege user to administrator, and CVE-2026-42271 allows an authenticated user to run commands on the LiteLLM host; the latter was added to CISA's Known Exploited Vulnerabilities catalog, indicating active exploitation. Anyone patching LiteLLM deployments can keep tabs on new CVEs and exploit disclosures through daily.dev."}}]} ```