A detailed red team research post demonstrating how a compromised LiteLLM proxy-admin credential can be used to reroute all LLM traffic through an attacker-controlled gateway. The attack chain — called 'LLM Heist' — covers four stages: harvesting backend LLM provider API keys, provisioning them on an attacker-controlled LiteLLM instance, intercepting and monitoring all inference traffic, and injecting forged text responses or tool calls (including arbitrary shell commands) downstream of the model, bypassing prompt-level defenses. The post includes a step-by-step walkthrough with a custom tool called `llm-heist`, MITRE ATT&CK mappings, and blue team mitigations such as alerting on `api_base` changes, egress restrictions, credential rotation, and audit logging forwarded to a SIEM.
