The LiteLLM fallout is a CI credential problem, not an AI problem
August 18, 2026. From issue 2 of The Compliance Brief, one story for teams running an ISO 27001 or ISO 42001 management system.
Issue 2 of The Compliance Brief went to subscribers on August 18, 2026. One of its 5 stories bears on ISO 27001, ISO 42001 and supplier risk, and they are below in short form. The full issue, with every take in full, is on traztech.ca.
Free weekly email
Get the next issue on Tuesday
One email a week: what changed in security and compliance, and what it means for teams running an ISO 27001 or ISO 42001 management system.
Free. One email every Tuesday from Jacob Masse, and nothing else: signing up here does not add you to any other sequence. One click unsubscribes.
Source: Help Net Security
A 153GB archive stolen in the LiteLLM supply chain attack has surfaced, containing 433,909 files. Hudson Rock attributed 118,829 CI runner dumps to 2,488 corporate domains, with credentials tied to AWS, Samsung, Cisco and Salesforce among them.
Our take, in short
CI runner dumps are the worst possible thing to lose, because build environments tend to hold the credentials nobody wants to rotate: cloud keys, registry tokens, signing material, production database strings. If you added an LLM gateway or proxy to your stack in the last year, treat every secret that environment could read as burned and rotate on that basis...
Read the full take on traztech.ca
Also in issue 2
Outside ISO 27001, ISO 42001 and supplier risk, but in the same email:
- An AWS key in a public JavaScript bundle took down 1,000 charity CRMs
- Metabase SQL injection is now on the KEV list
- A year-long campaign is quietly draining Salesforce and ServiceNow tenants
- When the subprocessor is breached, your customer writes the letter with your name in it
Older: issue 1 All issues on ISO27K Newer: issue 4
Free weekly email
Get it every Tuesday
The next issue goes out Tuesday morning. Read it in your inbox instead of finding it here a week later.
Free. One email every Tuesday from Jacob Masse, and nothing else: signing up here does not add you to any other sequence. One click unsubscribes.