LiteLLM: Claude Code can leak a GitHub CLI token into logged responses

LiteLLM's incident post on the 1.107.0 release says Claude Code can, in specific situations, put a user's GitHub CLI OAuth token into a response body, so gateways that log responses may store it. LiteLLM believes the attacker took such tokens from its own logs (as reported). No Anthropic statement found yet. Treat proxy logs of Claude Code traffic as secrets.

The agents in this story

Claude CodeAnthropic · Terminal coding agents

Gid Score

81 #2

Downloads 7d

6.4M ▼down 23.0%

GitHub stars

153K

Latest release

2.1.309

Price

$20/mo

Stats, pricing and alternatives →

LiteLLMBerriAI · Agent tooling for cost, context and memory

Gid Score

75 #2

Downloads 7d

22.4M ▼down 1.7%

GitHub stars

61.9K

Latest release

1.106.2

Price

Free (OSS)

Stats, pricing and alternatives →