Hijacking LiteLLM: The Consequences of Compromising an AI Gateway

Hijacking LiteLLM: The Consequences of Compromising an AI Gateway

Researcher Johann Rehberger analyzed an attack scenario involving LiteLLM — a popular AI gateway that provides a unified interface to various LLM providers. The research demonstrates how dangerous compromising an AI gateway can be. The routing technique itself is not a LiteLLM vulnerability; it relies entirely on legitimate, documented gateway management functionality.

Initial condition: the attacker has already obtained the LITELLM_MASTER_KEY or equivalent proxy-admin credentials. Code execution on the victim's LiteLLM server is not required. Using LiteLLM's built-in management functions, the attacker can change request routing and redirect LLM traffic through an AI gateway under their control. The LiteLLM endpoint and virtual keys remain unchanged for users.

What this could lead to: • API key theft — LiteLLM resolves the actual LLM provider credential when sending a backend request. After the traffic is redirected, the provider key is sent to the attacker-controlled gateway. • LLM traffic interception — using the stolen credentials, the attacker can proxy requests to the legitimate provider while intercepting prompts and responses. • Response tampering — LiteLLM hooks on the attacker-controlled gateway can be used to modify responses after they have been generated by the model. • Tool call injection — if the client is an AI agent with access to tools, the attacker can inject a forged tool call that the original LLM never generated. This does not bypass client-side tool authorization by itself, but if the agent is configured to execute tools automatically, it can lead to command execution.

An AI gateway becomes a critical infrastructure control point — by compromising a single proxy-admin credential, an attacker can potentially gain control over the gateway's AI traffic, intercept provider credentials, collect prompts and responses, and modify requests or responses, including tool calls.

Article: https://embracethered.com/blog/posts/2026/hijacking-litellm-for-fun-and-profit/