{"slug": "wiz-says-credentials-tied-to-litellm-attack-were-used-to-probe-amazon-bedrock", "title": "Wiz says credentials tied to LiteLLM attack were used to probe Amazon Bedrock", "summary": "Security firm Wiz reported that AWS credentials stolen through a compromised LiteLLM release were validated and used to call Amazon Bedrock's model-listing APIs between 11:20 a.m. and 12:01 p.m. CDT on Oct. 21, within hours of the compromise. Wiz said the attacker tested instance-role credentials harvested from compromised CI runners and Kubernetes nodes across multiple environments, an early sign of attempted AI-account abuse.", "body_md": "# Wiz says credentials tied to LiteLLM attack were used to probe Amazon Bedrock\n\n**Security firm Wiz says AWS credentials stolen through the compromised LiteLLM release were tested within hours.**\n\n        By [Emerson Redding](https://runtimewire.com/author/emerson-redding)\n        · Published \n        · Updated \n\nPrimary source: [wiz.io](https://www.wiz.io/blog/litellm-compromised-steals-credentials)\n\n## Why it matters\n\nWiz's findings show AWS credentials stolen through LiteLLM being tested against Amazon Bedrock within hours, an early sign of attempted AI-account abuse.\n\nCredentials stolen through the compromised [LiteLLM](https://litellm.ai/?ref=runtimewire) release were put to work within hours, according to security firm Wiz. Between 11:20 a.m. and 12:01 p.m. CDT on Oct. 21st, an attacker validated AWS instance-role credentials \"harvested from compromised CI runners and Kubernetes nodes across multiple environments,\" then called Amazon Bedrock's model-listing APIs, Wiz said in an [update to its research](https://www.wiz.io/blog/litellm-compromised-steals-credentials?ref=runtimewire).…\n\nWhen you purchase through links in our articles, [we may earn a small commission](https://runtimewire.com/affiliate-monetization-standards). This doesn’t affect our editorial independence.", "url": "https://wpnews.pro/news/wiz-says-credentials-tied-to-litellm-attack-were-used-to-probe-amazon-bedrock", "canonical_source": "https://runtimewire.com/article/wiz-says-credentials-tied-to-litellm-attack-were-used-to-pro-201f7e", "published_at": "2026-10-22 00:30:48+00:00", "updated_at": "2026-10-22 03:41:15.848911+00:00", "lang": "en", "topics": ["ai-safety", "ai-infrastructure", "large-language-models"], "entities": ["Wiz", "LiteLLM", "Amazon Bedrock", "Amazon Web Services"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/wiz-says-credentials-tied-to-litellm-attack-were-used-to-probe-amazon-bedrock", "markdown": "https://wpnews.pro/news/wiz-says-credentials-tied-to-litellm-attack-were-used-to-probe-amazon-bedrock.md", "text": "https://wpnews.pro/news/wiz-says-credentials-tied-to-litellm-attack-were-used-to-probe-amazon-bedrock.txt", "jsonld": "https://wpnews.pro/news/wiz-says-credentials-tied-to-litellm-attack-were-used-to-probe-amazon-bedrock.jsonld"}}