LiteLLM cuts ties with controversial startup Delve after malware attack

LiteLLM, one of the most widely used tools for routing requests to language models, has announced it is ending its relationship with startup Delve, amid a serious security incident and pressure from the community.

LiteLLM used Delve to obtain two security compliance certifications. Such certifications matter to enterprise customers: they signal process maturity and adherence to standards such as SOC 2 or ISO. Last week, however, LiteLLM fell victim to an attack using credential-stealing malware, one of the most dangerous types of threat because it gives attackers direct access to systems and secrets.

Delve, a startup that specializes in speeding up security audits, has long been a source of controversy in the tech community. Critics point to aggressive marketing practices and the questionable rigor of the certifications it issues. The LiteLLM incident has amplified those concerns: a company that is supposed to help clients look secure turned out to be tied to a partner at the moment of a serious compromise.

LiteLLM is widely used across the industry as a proxy layer between applications and dozens of language models, from OpenAI and Anthropic to open-source options. Requests from enterprise customers, startups and developers around the world pass through it, which makes any vulnerability in its infrastructure a potentially large-scale problem.

The LiteLLM team has not disclosed details about the scale of the data leak or whether end users were affected. However, the decision to publicly cut ties with Delve suggests that leadership sees this partnership choice as a reputational and operational risk.

The story shows clearly how vulnerable the supply chain in AI infrastructure is. Intermediary tools such as AI gateways are becoming critical nodes, and any weakness in their partner ecosystem immediately turns into a risk for everyone who relies on them.