Four AI breaches this week all turned on credentials

Four incidents reached the ledger this week, and not one of them was a model doing something unexpected. LiteLLM shipped a poisoned release to PyPI and Docker Hub. PingCAP lost source code to a stolen service account. OpenCode exposed provider API keys from a system it was in the middle of switching off. 302.ai left 22.72TB of files on a storage bucket with no authentication in front of it. Every one turned on a credential, or on an access path nobody was watching.

The thing taken is a key

The LiteLLM 1.107.0 release carried a credential stealer that runs on every Python start and a background loader that fetches remote code hourly, built from a lookalike repository after attackers obtained the GitHub CLI credentials of three developers, The Hacker News reported. The chain begins and ends in the same place: credentials in, credentials out, with the package registry as the delivery route.

OpenCode makes the cost legible. An intruder reached a legacy Console system the company was decommissioning on the night of October 16 and may have exposed the OpenAI, Anthropic and Google API keys of about 1.4% of Console users, with several developers reporting unauthorized provider charges above $1,000, according to Axios. A leaked provider key is not a record to regret at disclosure time. It is a spending instrument, and it works the moment someone else has it.

PingCAP names the same asset class. An unauthorized party used stolen service account credentials to reach internal systems between September 9 and October 7, taking source code and TiDB Cloud account records including SQL editor text and one table of encrypted API key values, Dark Reading reported. That table was encrypted, which is the difference between a disclosure and a bill. It is also the only part of this list where the defence was in place before the intrusion.

Dwell time does the damage

None of the four needed anything clever. They needed time.

• PingCAP's intruder held access for roughly four weeks, from September 9 to October 7, before the company could draw a line under it.
• LiteLLM's loader reached out hourly, so the window was not the install but every hour after it.
• 302.ai left 17.6 million files exposed, among them more than 144,000 chat logs holding user prompts, replies, model names and token costs, and took the data offline only after Cybernews reported it.

That last one is the uncomfortable detail. The bucket was not found by monitoring, it was found by a publication, and the clock on it had been running for as long as nobody looked. The content is worth noting too: prompts and replies are the sensitive part, but model names and token costs are a map of what a customer runs and what it costs them.

Nothing in the model layer fixes any of this

Read together, the four failures sit in ordinary plumbing: a package registry, a service account, a decommissioning schedule, a storage policy. The AI part of the AI stack was not breached in any of them. What leaked was the key to it.

The ledger's own habit is to record the model releases and the funding, because that is where the movement is. This week is a reminder that the attack surface is somewhere else, and it is the boring part: who holds the credential, how long it stays valid, and what happens to a system on the night it is being turned off.