Silicon Valley’s two biggest dramas have intersected: LiteLLM and Delve

This is one of those Silicon Valley real-life episodes that seem pulled from the HBO satire show. This week, some really atrocious malware was discovered in an open source project developed by Y Combinator graduate LiteLLM. LiteLLM gives developers easy access to hundreds of AI models and provides features like spend management. It’s a breakout hit, downloaded as often as 3.4 million times per day, according to Snyk, one of the many security researchers monitoring the incident. The project had 40K stars on GitHub and thousands of forks (those who used it as a base to alter and make it their own). The malware was discovered, documented, and disclosed by research scientist Callum McMahon of FutureSearch, a company offering AI agents for web research. The malware slipped in through a “dependency,” meaning other open source software that LiteLLM relied upon. It then stole the log-in credentials of everything it touched. With those credentials, the malware gained access to more open source packages and accounts to harvest more credentials, and so on. The malware caused McMahon’s machine to shut down after he downloaded LiteLLM. That event prompted him to investigate and discover it. Ironically, a bug in the malware caused his machine to blow up. Because that bit of nasty code was so sloppily designed, he (as well as famed AI researcher Andrej Karpathy) concluded it must have been vibe coded. The LiteLLM developers have been working nonstop this week to rectify the situation, and the good news is that it was caught relatively fast, likely within hours. There’s another part to this saga that folks on X can’t stop talking about. LiteLLM, as of March 25 when we looked, still proudly displays on its website that it has passed two major security compliance certifications, SOC2 and ISO 27001. But it used a startup called Delve for those certifications. Techcrunch event Disrupt 2026: The tech ecosystem, all in one room Your next round. Your next hire. Your next breakout opportunity. Find it at TechCrunch Disrupt 2026, where 10,000+ founders, investors, and tech leaders gather for three days of 250+ tactical sessions, powerful introductions, and market-defining innovation. Register now to save up to $400. Save up to $300 or 30% to TechCrunch Founder Summit 1,000+ founders and investors come together at TechCrunch Founder Summit 2026 for a full day focused on growth, execution, and real-world scaling. Learn from founders and investors who have shaped the industry. Connect with peers navigating similar growth stages. Walk away with tactics you can apply immediatelyOffer ends March 13. San Francisco, CA | October 13-15, 2026 REGISTER NOW Delve is the Y Combinator AI-powered compliance startup that’s been accused of misleading its customers about their true compliance conformity by allegedly generating fake data and using auditors that rubber-stamp reports. Delve has denied these allegations. LiteLLM website features security cert by Delve.Image Credits:LiteLLM There is one point of nuance here worth understanding. Such certifications are intended to show that a company has strong security policies in place to limit the possibility of incidents like this one. Certifications don’t automatically prevent a company, like LiteLLM, from being hit by malware. While SOC 2 is supposed to cover policies surrounding software dependencies, malware can still slip in. Even so, as engineer Gergely Orosz pointed out on X when he saw people snickering about it online, “Oh damn, I thought this WAS a joke. … but no, LiteLLM *really* was ‘Secured by Delve.’” As for LiteLLM, CEO Krrish Dholakia had no comment on the use of Delve. He’s still busy cleaning up the unfortunate mess from being a victim of attack. “Our current priority is the active investigation alongside Mandiant. We are committed to sharing the technical lessons learned with the developer community once our forensic review is complete,” he told TechCrunch. Topics Delve, malware, Security, security compliance, Startups Julie Bort Venture Editor Julie Bort is the Startups/Venture Desk editor for TechCrunch. You can contact or verify outreach from Julie by emailing julie.bort@techcrunch.com or via @Julie188 on X.

View Bio November 4 Boston, MA Actively scaling? Fundraising? Planning your next launch?TechCrunch Founder Summit 2026 delivers tactical playbooks and direct access to 1,000+ founders and investors who are building, backing, and closing. REGISTER NOW Most Popular Google unveils TurboQuant, a new AI memory compression algorithm — and yes, the internet is calling it ‘Pied Piper’ Sarah Perez Kentucky woman rejects $26M offer to turn her farm into a data center Graham Starr Someone has publicly leaked an exploit kit that can hack millions of iPhones Lorenzo Franceschi-Bicchierai Zack Whittaker Cursor admits its new coding model was built on top of Moonshot AI’s Kimi Anthony Ha Delve accused of misleading customers with ‘fake compliance’ Anthony Ha An exclusive tour of Amazon’s Trainium lab, the chip that’s won over Anthropic, OpenAI, even Apple Julie Bort Cyberattack on vehicle breathalyzer company leaves drivers stranded across the US Zack Whittaker