project
LiteLLM is an open-source gateway/proxy that routes calls to many LLM providers through one API, offering logging, spend tracking, and self-hosted deployment.
No evidence-backed relationships are recorded.
MCP Python SDK maintainers rated a flaw that let a connected server choose where OAuth secrets were sent High, at 7.5. For its two machine-to-machine providers, upgrading changes nothing until the client names the issuer it expects.
Reality
NVD logged CVEs for four MCP servers in about 35 hours, each because every tool it exposes needs no authentication. A fifth MCP flaw, LiteLLM's authentication bypass, is already on CISA's exploited-vulnerabilities list.
Reality
LiteLLM's standalone Rust path added 0.7 ms of p99 latency against 257.7 ms for its Python proxy in July 22 benchmark artifacts reviewed on dev.to. Logging, persistence and spend tracking were off for the run, so the gap measures forwarding alone.
Reality
LiteLLM launched Lens on September 30, a tool that uses AI agents to find recurring failures across agent traces sent through its model gateway. Customers host the analyzer and its databases, and the 200,000-trace volume CTO Ishaan Jaffer cites is a future target Lens has not been measured against.
Reality
Google's threat intelligence group counts 18 exploited flaws a month in 2026, up from 10.5 in 2025, while zero-days rose only from eight to 11. GTIG attributes most of the added attacks to fast weaponization of disclosed n-days, so the exposure sits in the days after a patch ships.
Perspective Coverage
4 publishersReality
Google's Threat Intelligence Group counted 141 flaws exploited in the wild from January to August, while monthly disclosures doubled to 10,740. Patch teams do better sorting by that exploited set than by the total, though attackers now reach some public flaws within days.
Reality
LiteLLM's MCP test endpoints let any valid proxy key run arbitrary commands on the gateway, rated CVSS 8.8. CISA added the flaw to its Known Exploited Vulnerabilities catalog on June 8, 2026, confirming exploitation in the wild.
Reality
Misha, who works on Gobare, found in public docs that OpenAI may delete a sandbox idle for an hour and Gobare pauses one after five minutes. Perplexity promises nothing between responses, so jobs that wait on a human or serve a preview have to fit one of those clocks.
Reality
A payments company is paying roughly 140 times annualised revenue for the switchboard that decides which model your code calls. The anti-lock-in pitch is now the lock-in.
Perspective Coverage
3 publishersReality
Two men arrested in Australia this week are alleged TeamPCP members. The AFP estimate filed alongside the case puts the worm's take at more than 500,000 credentials and 300GB of data, and that scale makes token lifetime the live question.
Perspective Coverage
17 publishersReality
SonicWall's CVSS 10.0 SSRF chains into command execution on remote access appliances, and JFrog Artifactory hands unauthenticated attackers admin under default configuration. Reverse shells and miners are already landing.
Perspective Coverage
13 publishersReality
LLM moderation queues need at most one current classification per accepted report, stored under a unique key before the queue ack, a dev.to guide argues. It plans for timeouts, lost leases and racing workers, and keeps unclassified reports visibly pending so a replay can still find them.
Reality
Wiz found 294 of 3,074 internet-facing LiteLLM gateways answering admin requests in February, and two thirds of those had no key set at all rather than the documented sk-1234. That changes what needs fixing.
Reality
Austin Larsen of Google's threat intelligence group says a Mandiant persona sat in TeamPCP's inner circle from almost the start of the campaign. For the companies the group breached, that infiltration was the warning system.
Reality
A dev.to guide to GPT-5.6 pricing shows batch halving both token rates and a cheap-first cascade saving money until 9 in 10 calls escalate. Batch is opt-in and caching fails silently on short prefixes, so the default request often pays list price.
Reality
CISA's exploited-vulnerability catalog now holds entries for LiteLLM, Kestra and Starlette, according to a dev.to writeup, and the quickstart docs for those tools still keep provider API keys in the process environment an attacker reads first.
Reality
TeamPCP hijacked developer accounts, poisoned hundreds of programs and released a worm to automate the spread. Google says the inside access let it warn victims, revoke stolen credentials and help patch an AI-developed zero-day.
Reality
LiteLLM works as a drop-in OpenAI replacement for teams running their own clusters, while managed gateways suit teams renting inference. OpenRouter's reported $113M round at a $1.3B valuation funds the rented side.
Reality
A single September 2026 KEV batch produced 1,262,273 GitLab matches and nothing at all for Cisco Secure Firewall Management Center, because the console holding one of the two 10.0 bugs is the one passive scanning cannot fingerprint.
Reality
A dev.to writeup pits Bifrost against LiteLLM on a shared four-core VPS, using the harness the Bifrost team maintains. The widest gap it reports traces back to a worker default the official LiteLLM image leaves unset.
Reality
Security · September 17, 2026 · 1 publisher
Build · September 16, 2026 · 1 publisher
Build · September 16, 2026 · 1 publisher
Invest · September 15, 2026 · 1 publisher
Build · September 15, 2026 · 1 publisher
Build · September 11, 2026 · 1 publisher
Leadership · September 11, 2026 · 1 publisher
Build · September 10, 2026 · 1 publisher
Build · September 8, 2026 · 1 publisher
Product · September 8, 2026 · 1 publisher
Build · September 5, 2026 · 1 publisher
Build · September 4, 2026 · 1 publisher
Security · September 3, 2026 · 1 publisher
Security · August 28, 2026 · 1 publisher
Build · September 2, 2026 · 1 publisher
Security · September 2, 2026 · 1 publisher
Build · September 2, 2026 · 1 publisher
Build · August 31, 2026 · 1 publisher
Build · August 31, 2026 · 1 publisher
Security · August 28, 2026 · 1 publisher
Science · August 28, 2026 · 1 publisher
Security · August 28, 2026 · 1 publisher
Security · August 28, 2026 · 1 publisher
Science · August 28, 2026 · 1 publisher
Security · August 28, 2026 · 1 publisher
Build · August 27, 2026 · 1 publisher
Build · August 27, 2026 · 1 publisher
Security · August 27, 2026 · 1 publisher
Security · August 26, 2026 · 1 publisher
Build · August 25, 2026 · 1 publisher
Build · August 23, 2026 · 1 publisher
Science · August 20, 2026 · 1 publisher
Science · August 19, 2026 · 1 publisher
Science · August 19, 2026 · 1 publisher
Build · August 18, 2026 · 1 publisher
Leadership · August 18, 2026 · 1 publisher
Build · August 18, 2026 · 1 publisher
Build · August 17, 2026 · 1 publisher
Build · August 16, 2026 · 1 publisher
Security · August 14, 2026 · 1 publisher