Picture a Tuesday morning in a mid-sized company. The engineering team is doing what they do every week: pulling the newest version of a free, widely trusted security tool into their build system. It is the boring kind of maintenance nobody writes a blog post about. Somebody clicks approve on the update. Coffee gets refilled. The tool runs, scans for problems, reports back, and everyone moves on.
Except this time the tool was reporting back to somebody else too.
That, in rough shape, is what happened in the supply-chain attack disclosed in 2026, in which terabytes of credentials belonging to more than 2,500 organizations — including major tech firms — ended up exposed online. The original compromise traces back to March 24, 2026, and reporting attributes it to a financially motivated group calling itself TeamPCP. The point of entry was an open-source security tool, the kind of software that exists specifically to find weaknesses. Coverage has named LiteLLM, which streamlines AI development work, and Trivy, a scanner that looks for vulnerabilities, in connection with the incident.
Why I am writing about this on an AI agents site
Because credentials are the whole ballgame for agents.
When people imagine an AI agent, they usually picture the conversation part — you ask, it answers. The actual work happens somewhere less glamorous. An agent that books your travel needs access to a calendar and a payment method. An agent that triages support tickets needs access to your ticketing system, your customer database, maybe your billing records. An agent that writes and deploys code needs keys to your cloud account.
Those accesses are stored as credentials: API keys, tokens, passwords. They are long strings of characters that mean “this software is allowed in here, no questions asked.” An agent without credentials is a very articulate houseplant. An agent with credentials is a coworker who never sleeps.
So when terabytes of credentials leak, what leaked was not just data. It was permission. Whoever holds those strings can walk through the same doors your agents were walking through, wearing the same badge.
The part that makes supply-chain attacks nasty
Most of us have absorbed the basic security advice: do not click strange links, do not reuse passwords, be suspicious of emails from princes. All of that assumes the danger arrives from outside, looking suspicious.
A supply-chain attack skips that entirely. Instead of attacking 2,500 organizations one at a time, you compromise one thing all 2,500 already trust and invite inside on purpose. The malicious code arrives through the front door, in an update, signed and expected. Nobody had to be careless.
There is a bleak irony in a security scanner being the vehicle. Scanning tools need broad visibility by design — they have to see your code, your configuration, your dependencies to tell you what is wrong with them. That visibility is exactly what makes them a rich target. The smoke detector had a microphone in it.
What this means if you are not technical
You are probably not the person approving dependency updates. But if your team is adopting AI agents, or you are deciding whether to, this incident is a useful lens for asking better questions.
- What can this agent actually reach? Not what it does on a normal day — what it is technically permitted to do. Those are rarely the same list.
- How would we find out if its credentials were stolen? If the answer involves reading the news, that is a gap.
- How fast can we cut off access? Rotating a key should be a routine operation, not a small crisis.
- Whose software is inside our software? Every AI tool sits on a stack of other people’s code. You inherit their security along with their features.
None of that requires you to read code. It requires you to treat agent access the way you would treat handing out office keys — sparingly, with a record of who has what, and a plan for changing the locks.
The uncomfortable takeaway
The instinct after a story like this is to go looking for the mistake. Somebody must have been sloppy. Usually there is a name to attach and a lesson that sounds like “be more careful.”
This one does not offer that comfort. The organizations affected were doing the recommended thing — running security tooling, keeping it updated. Their reward was exposure, at scale, through a channel they were told to trust.
Which is why the more durable lesson is about blast radius rather than prevention. You cannot verify every piece of software in your stack, and neither can I. What you can decide is how much any single compromised component gets to reach. Agents make that decision more consequential, because we are handing them more keys every quarter, often faster than we are writing down which keys we handed over.
The scanner will be patched. The credentials are already out. Worth asking, this week, which of yours are in the pile.
🕒 Published: