# Wiz Finds AWS Credentials Used to Test Amazon Bedrock

> Security firm Wiz reports stolen AWS credentials from LiteLLM attack were used to probe Amazon Bedrock within hours.
- Title: Wiz Finds AWS Credentials Used to Test Amazon Bedrock
- Summary: Security firm Wiz reports stolen AWS credentials from LiteLLM attack were used to probe Amazon Bedrock within hours. Wiz says credentials stolen via…
- Keywords: breaking, wiz, aws, lite llm, amazon bedrock, security, credentials, attack, technology, Finds, Used, Test
- Source: RuntimeWire — https://runtimewire.com/article/wiz-says-credentials-tied-to-litellm-attack-were-used-to-pro-201f7e
- Author: RuntimeWire
- Published: 2026-10-22T00:30:48.977+00:00
- Read time: 1 min
- Topics: breaking, wiz, aws, lite llm, amazon bedrock, security, credentials, attack, technology, ai
## Wiz security update
Wiz reports credentials stolen through compromised LiteLLM were tested against Amazon Bedrock within hours.

> harvested from compromised CI runners and Kubernetes nodes across multiple environments
## Attack timeline
Between 11:20 a.m. and 12:01 p.m. CDT on Oct. 21st, an attacker validated AWS instance-role credentials.
## Attack action
The attacker called Amazon Bedrock's model-listing APIs using harvested credentials.
## Key takeaway

Wiz says credentials stolen via compromised LiteLLM were tested against Amazon Bedrock within hours of theft.