Wiz says credentials tied to LiteLLM attack were used to probe Amazon Bedrock

Security firm Wiz says AWS credentials stolen through the compromised LiteLLM release were tested within hours.

        By [Emerson Redding](https://runtimewire.com/author/emerson-redding)
        · Published 
        · Updated 

Primary source: [wiz.io](https://www.wiz.io/blog/litellm-compromised-steals-credentials)

Why it matters #

Wiz's findings show AWS credentials stolen through LiteLLM being tested against Amazon Bedrock within hours, an early sign of attempted AI-account abuse.

Credentials stolen through the compromised LiteLLM release were put to work within hours, according to security firm Wiz. Between 11:20 a.m. and 12:01 p.m. CDT on Oct. 21st, an attacker validated AWS instance-role credentials "harvested from compromised CI runners and Kubernetes nodes across multiple environments," then called Amazon Bedrock's model-listing APIs, Wiz said in an update to its research.…

When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.