# Wiz says credentials tied to LiteLLM attack were used to probe Amazon Bedrock

> Source: <https://runtimewire.com/article/wiz-says-credentials-tied-to-litellm-attack-were-used-to-pro-201f7e>
> Published: 2026-10-22 00:30:48+00:00

# Wiz says credentials tied to LiteLLM attack were used to probe Amazon Bedrock

**Security firm Wiz says AWS credentials stolen through the compromised LiteLLM release were tested within hours.**

        By [Emerson Redding](https://runtimewire.com/author/emerson-redding)
        · Published 
        · Updated 

Primary source: [wiz.io](https://www.wiz.io/blog/litellm-compromised-steals-credentials)

## Why it matters

Wiz's findings show AWS credentials stolen through LiteLLM being tested against Amazon Bedrock within hours, an early sign of attempted AI-account abuse.

Credentials stolen through the compromised [LiteLLM](https://litellm.ai/?ref=runtimewire) release were put to work within hours, according to security firm Wiz. Between 11:20 a.m. and 12:01 p.m. CDT on Oct. 21st, an attacker validated AWS instance-role credentials "harvested from compromised CI runners and Kubernetes nodes across multiple environments," then called Amazon Bedrock's model-listing APIs, Wiz said in an [update to its research](https://www.wiz.io/blog/litellm-compromised-steals-credentials?ref=runtimewire).…

When you purchase through links in our articles, [we may earn a small commission](https://runtimewire.com/affiliate-monetization-standards). This doesn’t affect our editorial independence.