LiteLLM ends security partnership with Delve after malware incident
LiteLLM's open source version was compromised by credential-stealing malware, prompting the AI gateway company to end its security certification partnership with Delve and switch to competitor Vanta. The move follows accusations that Delve had misled customers about compliance through allegedly fabricated data and complicit auditors.
What happened
LiteLLM's open source version fell victim to credential-stealing malware.
Prior to the incident, LiteLLM had obtained two security compliance certifications from AI compliance startup Delve.
On March 30, 2026, LiteLLM CTO Ishaan Jaffer announced the company would be using competitor Vanta to re-certify and would find an independent third-party auditor to verify its compliance controls.
Reported impact
Delve has been accused of misleading its customers about their true compliance by allegedly generating fake data and using auditors that rubber-stamped their reports.
Index analysis
Security compliance certifications are intended to verify that a company has procedures in place to minimize potential incidents.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.