- Engineer — Act: If you run LiteLLM, immediately check whether your admin key is still “sk-1234” and rotate it to a strong credential; a compromised gateway exposes all upstream model API keys and full prompt/completion history to anyone who finds the instance.
- SOC/IR — Plan: Build a detection rule to flag any LiteLLM API requests authenticating with the literal string “sk-1234”, and sweep existing gateway/proxy logs since initial deployment for unauthorized admin activity.
- Leader — Plan: Direct engineering to inventory all internal and vendor-managed LiteLLM deployments and confirm no default admin credentials are in use; a misconfigured AI gateway exposes both uncapped API spend and the full record of what your applications send to model providers.