SIGN IN / UP 
Control Panel 
Three major security breaches happened in just one week in October 2026. The incidents affected the popular LiteLLM tool, the Railway hosting platform, and the OpenCode service. In all three cases, attackers were after the same thing: API keys for OpenAI, Anthropic, Google, and cloud services.
A stolen API key is like having your bank card in someone else's hands. They use it, but you get the bill. If you've connected AI to your website, bot, or application, check your keys today. Here's a simple guide.
What Is an API Key and Why Do Hackers Steal It?
An API key is a long string of characters, such as sk-ant-... or sk-proj-.... Your website or bot sends this key to a service like ChatGPT or Claude. The service recognizes the key and knows it's you — and that you're the one paying.
Think of it as a bank card without a PIN. Anyone who knows the number can spend money. Except they're spending yours.
Why are these keys such attractive targets?
- They're worth real money. With someone else's key, attackers can use expensive AI models for free or resell access. A single stolen key can generate tens of thousands of dollars in charges in just one day.
- Keys are bought in bulk. Some companies use stolen keys to collect responses from large AI models and train their own models on that data. This is called distillation. There's a constant demand for these keys.
- Keys are often stored alongside other secrets. Database passwords, cloud credentials, and payment system tokens may be in the same place. Steal one thing, and you might get everything.
LiteLLM: A Poisoned Update
LiteLLM is a popular intermediary tool that allows websites and bots to communicate with dozens of AI services through a single interface. It gets around 23 million downloads per week.
What happened. On October 21, attackers published a malicious version of LiteLLM, numbered 1.107.0, under the project's name. It remained available on PyPI and Docker for about two hours. During that time, it was downloaded approximately 49,000 times.
Imagine someone putting poison into medicine packages at a factory. The packaging is genuine, the manufacturer is legitimate, but the contents are dangerous.
What the malicious version did. It collected valuable information from computers and servers: browser passwords, SSH keys, cloud credentials, and AI API keys. It also installed a backdoor so attackers could return at any time. The stolen keys were being tested within hours.
How it started. In May, LiteLLM developers accidentally exposed an internal key in a public GitHub repository. Nobody replaced it. In October, an attacker found that key and used it to gain access to the system responsible for releasing updates.
The lesson is simple: one forgotten key sat exposed for six months and led to a malicious update downloaded tens of thousands of times.
All versions before 1.107.0 are safe. LiteLLM also promised to disclose another vulnerability on October 27. If you use LiteLLM, keep an eye on its security updates.
Railway: A Hosting Platform Breach
Railway is a cloud platform where developers deploy their applications. Passwords and API keys are stored there in what are called environment variables.
What happened. On October 21, Railway detected suspicious activity in the systems used to store these variables. According to the company, an attacker may have accessed them and decrypted some of the data.
Imagine someone breaking into the concierge's office rather than your apartment — the office where spare keys to every apartment in the building are kept.
The consequences. Railway asked all customers to rotate their keys and passwords. Deployments were suspended for approximately 17 hours. Users reported that their AI API keys had already been used before the official warning was issued. According to researchers, around $371,000 was stolen from cryptocurrency wallets whose keys had been stored on Railway. Railway itself has not confirmed that connection.
Railway believes the breach was part of a series of attacks against hosting platforms aimed at stealing AI API keys. Two days earlier, hosting provider Zeabur reported a similar incident.
OpenCode: Keys Left in an Old System
OpenCode is a popular AI coding assistant. It has a web dashboard called Console, where users can store their OpenAI, Anthropic, or Google API keys so the whole team can use them.
What happened. On the night of October 16, an attacker gained access to OpenCode's old infrastructure. The company was preparing to shut it down, but customer API keys were still stored there. The breach affected 1.4% of Console users.
It's like moving to a new office but leaving a safe full of documents in the old one, where nobody is guarding the doors anymore.
What users noticed. One developer reported receiving unexpected spending alerts from three services overnight. Google automatically blocked suspicious activity. OpenAI and Anthropic continued charging his accounts until he manually revoked the keys.
Important: deleting a key from OpenCode alone won't solve the problem. Anyone who copied it can continue using it. You must revoke the key directly in the account of the service that issued it.
Check Whether You Were Affected
LiteLLM. Check the installed version on your server:
pip show litellm
If the output shows Version: 1.107.0, your server is infected. Also look for files left behind by the malicious version:
find / -name "cook.pth" -o -name "litellm-1.107.0.dist-info" 2>/dev/null
If you run LiteLLM in Docker, check whether you updated the image on October 21. The affected tags were v1.107.0, latest, main-latest, and main-stable.
Railway. If you have even one project hosted there, assume you may have been affected. Railway itself has asked all customers to rotate their credentials.
OpenCode. Check your email. OpenCode sent notifications to affected customers. If you didn't receive one but stored your API keys in OpenCode Console, it's still better to replace them. If you only use the locally installed application, your keys are stored on your own computer and were not involved in this breach.
Everyone else. Open your OpenAI, Anthropic, and Google dashboards and review your spending over the past two weeks. A sudden spike, especially overnight, is a warning sign.
How to Rotate Your API Keys Properly
You need to replace your keys without taking your website offline. Follow this order:
Create a new key in the dashboard of your provider: OpenAI, Anthropic, Google AI Studio, or another service.
Update the key in your website, bot, or application.
Test everything to make sure it still works.
Revoke the old key in the provider's dashboard. Only then will the attacker lose access to it.
It's like changing the locks after losing your keys. First, you install a new lock and distribute new keys to the right people. Then you get rid of the old ones.
Don't stop at AI API keys. If the key was stored on a server alongside other sensitive information, rotate everything: database passwords, cloud credentials, payment system tokens, and SSH keys.
If you installed LiteLLM 1.107.0, rotating keys isn't enough. The malicious version installed a backdoor. Simply uninstalling the package won't solve the problem. If someone has already broken into your home and copied the key to the back door, changing the front-door lock won't protect you. The safer approach is to rebuild the server from scratch and then rotate all credentials.
Set Spending Limits and Organize Your Credentials
You can't completely eliminate the risk of a leak. But you can reduce its financial impact.
Set spending limits for each key. Major AI providers allow you to configure monthly budgets. Think of it as setting a spending limit on your bank card. Even if someone steals it, they won't be able to spend beyond that limit.
Use one key per project. Don't share a single API key between your website, bot, and test environment. If one key leaks, you'll only need to replace that one, and you'll know where the leak came from.
Don't store keys in your code. Keep them in a
.envfile and add that file to.gitignoreso it won't be committed to your repository. That's how the LiteLLM breach started: a key was accidentally exposed on GitHub.Don't write keys to logs. Check that your website or bot doesn't save complete requests containing API keys and tokens. Attackers used logs to reach LiteLLM's update infrastructure.
Pin your software versions. Specify an exact version, such as
litellm==1.106.2, instead of simplylitellm. In Docker, avoid using thelatesttag. This prevents a malicious update from being installed automatically before you've reviewed it.
Checklist
Checked the installed LiteLLM version on the server
Checked whether I have projects hosted on Railway
Checked my email for an OpenCode notification
Reviewed spending in OpenAI, Anthropic, and Google dashboards
Rotated keys in the correct order: new key, testing, old key revoked
Rotated other passwords and credentials on the compromised server
Set spending limits for each API key
Removed API keys from source code and logs
Pinned software versions and Docker images
Don't Want to Handle It Yourself?
Finding every API key on a server is harder than it sounds. One might be in a .env file, another in a bot's settings, a third inside a Docker container, and a fourth accidentally written to logs. If the server may have been compromised, it also needs to be rebuilt without losing important data.
Zomro offers two options for situations like these.
SOD: We'll Check Your Server for You
Our system administrator will:
check whether the server has an infected LiteLLM version or traces of it;
locate stored API keys and passwords and advise which ones need replacing;
check whether sensitive credentials are being written to logs;
help migrate your project to a clean server if necessary.
Price: €12.50 per 15 minutes of work.
Premium: Fast Support When You Need It
When an API key leaks, your bill can grow every hour. A standard technical support request may take up to 10 hours to receive a response. With Premium, we respond within 5 to 30 minutes.
New data breaches and vulnerabilities appear every week. With Premium, you won't have to deal with them alone.
CLOUD VPS 
DEDICATED SERVERS 
HOSTING 
3 months