Check Point found LiteLLM let any signed-in user seize admin; 97 million downloads a month
Check Point showed that any signed-in LiteLLM user could seize the admin account of the gateway holding a company's every model key, the latest receipt in a year of backdoors and botnets. The biggest customers are now rewriting the layer rather than upgrading it, and the free middle of the AI stack is becoming paid infrastructure.
Richard Tang · 3 min read
The middle layer of the AI stack just failed as infrastructure, and the companies that depend on it have stopped upgrading and started rewriting. On October 13, Check Point+0.98% — Check Point, up 0.98 percent today Research, the research arm of the listed security firm, disclosed two high-risk flaws in LiteLLM, the open-source gateway that routes a company's model traffic to OpenAI$1.18T — OpenAI, private, latest valuation $1.18T, Anthropic$350B — Anthropic, private, latest valuation $350B, Google and the rest, and showed that a user signed in with even a basic account could seize its admin controls 12.
A week later Respan, a startup that had spent two years building on LiteLLM, open-sourced a replacement it wrote from scratch 3. This layer is turning from a free download into paid infrastructure, which is what it always was: a job.
Every provider key sits behind one permission check
A gateway exists to concentrate. Applications get one OpenAI-style endpoint, and the gateway holds the credentials for every provider behind it. Enterprises self-host LiteLLM to keep those keys inside their own perimeter, and the scale is real: roughly 97 million downloads a month, with Adobe−0.48% — Adobe, down 0.48 percent today and NASA named by the project itself and Netflix−4.31% — Netflix, down 4.31 percent today on its adopter list 14.
Concentration cuts both ways. Check Point found that the endpoint which changes the gateway's runtime settings never checked whether the caller was an administrator, so a low-privileged user could reset the admin password, read files off the host and run code; the flaws are reported fixed in version 1.83.9 2. A second flaw let an attacker redirect model calls and capture the provider keys the gateway stores 5.
Attackers moved to this layer before the market did
The pattern runs all year. In March, malicious versions of the LiteLLM package on PyPI, Python's package index, harvested cloud credentials until they were pulled 6. In June, CISA, the US cyber agency, listed a LiteLLM command-injection flaw as actively exploited 7.
Since April, Lumen's Black Lotus Labs, the threat unit of the listed telecom, has counted more than 3,400 hijacked servers, mostly exposed LiteLLM and Ollama installs mining cryptocurrency, until the GitHub+0.18% — GitHub, up 0.18 percent today repository whose poem encoded the botnet's command address disappeared and the campaign went quiet 8. As Black Duck's Boris Cipot put it, attackers need not breach the model providers directly when the trusted software sitting between provider and customer is softer 5.
Customers are rewriting the layer instead of upgrading it
Respan ran LiteLLM for thousands of organizations and wrapped it in more than 100,000 lines of its own code 3. A routine January upgrade broke connections, the cause was never found, and the team has backported fixes by hand ever since 3.
On October 20 it released the replacement: a Rust gateway with a small core where providers, protocols and security checks are all plugins, and a new provider is a 22-line file 3. LiteLLM is making the same admission in its own direction, porting its server to Rust one route at a time behind an off-by-default flag 9, while a maintainer apologized on Hacker News for code quality 10.
The project has shipped more than 1,500 releases 4; staying current with that treadmill is the work nobody budgeted for.
The money moves to whoever can bill for the layer
The payers are the enterprises that treated the gateway as free and now buy audits, key rotation and, where exposed, miner cleanup. The collectors will be whoever turns the layer into maintained infrastructure: LiteLLM now sells an enterprise tier with custom support agreements and markets a Rust core 4, Respan sells the hosted version of its gateway 3, and every disclosure from Check Point and Lumen demonstrates the demand 18.
That reward is deserved. The models were never the bottleneck here; the pipe was, and whoever makes the pipe dependable is doing the work that turns AI capability into something a business can run on.
Keep adopting AI, and budget for the middle: this layer was never free, only unbilled.
The daily newsletter
