All analysis was generated autonomously, without human review. Scores are analytical opinions drawn from the cited public sources, without hands-on testing. They are not audits, certifications, investment reports, purchasing advice, or evaluations of quality.
BerriAI builds LiteLLM, an open-source gateway that routes requests to more than 140 AI model providers through one interface. It sells to organizations giving hundreds of engineers and applications model access, with a hard spending cap on each team's key. Founded in 2023, it raised a $1.6 million seed from Y Combinator, Gravity Fund and Pioneer Fund. Named customers include Pfizer, which runs it for every team, plus NVIDIA, Netflix, Okta and AT&T. Attackers put malicious LiteLLM packages on PyPI in March 2026. CISA has since listed three LiteLLM flaws in its catalog of exploited vulnerabilities. BerriAI commissioned an audit, opened a bug bounty and completed a SOC 2 Type 2 report. A customer leaving would have to rebuild the keys, budgets and routing rules it set up in the gateway.
| Description | LiteLLM is an open-source AI gateway that puts more than 140 model providers behind one OpenAI-compatible interface, so platform teams can give developers, applications and agents model access with per-team keys, hard budgets and configurable guardrails. | [f1] |
|---|---|---|
| Founded | 2023 | [f2] |
| HQ | San Francisco, United States | [f3] |
| Funding | $1.6M total | [f2] |
| Latest funding | Seed (Y Combinator, Gravity Fund, Pioneer Fund), 2023 | [f2] |
| Deployment | SaaS, Self-hosted | [f4] |
| Product | What it does |
|---|---|
| LiteLLM | LiteLLM: Open-source AI gateway and proxy for 140+ LLM providers, adding virtual-key RBAC, budgets, rate limits, guardrails (PII masking, prompt-injection), and enterprise SSO, SCIM and audit logs. |
AI Defense Matrix
| Govern | Identify | Protect | Detect | Respond | Recover | |
|---|---|---|---|---|---|---|
| AI-Workload Platforms Inference servers, training platforms, vector DB platforms, and the model-loading supply chain. | ||||||
| AI Coding and Orchestration Tools AI coding tools and agentic orchestration tools on user devices, plus their plugins, skills, hooks, system prompts, scaffolding, harnesses, configuration settings, and MCP clients. | ||||||
| AI-Generated Code Code produced by AI tools, AI-assisted reviews, AI-generated infrastructure-as-code and tests, and vibe-coded apps that bypass CI/CD. | ||||||
| AI Traffic Paths to external and self-hosted AI services, MCP tool channels, agent-to-agent calls, model-registry downloads, and egress to unapproved AI services. AI gateways, LLM routers, and MCP gateways steer traffic along those paths. The steering decisions and their inputs belong here too: routing policies, MCP server registries, and agent naming and discovery services. | ||||||
| AI Model Model weights, fine-tuning checkpoints, model cards, registries, an AI bill of materials (AIBOM), and the third-party LLMs your enterprise consumes. | ||||||
| Training Data Datasets used for training, fine-tuning, and continued learning. | ||||||
| Runtime AI Data User prompts, inference inputs, RAG content, vector DB content, persistent agent memory, and interaction history. | ||||||
| AI Agent Identities AI agents as non-human principals, plus credentials, keys, permission scopes, service accounts, and delegation chains across agents and tools. |
LiteLLM is an open-source AI gateway and proxy for over 100 LLM providers, adding virtual-key RBAC, budgets, rate limits, guardrails for PII masking and prompt injection, and enterprise SSO and audit logs. It is mapped to the AI Defense Matrix. [f5]
How well the company can compete in its security market, scored across eight dimensions against public evidence.
| Dimension | Score | Rationale |
|---|---|---|
| Problem Clarity How precisely the company defines its problem, with evidence the problem exists at the scale claimed. | 3/5 | LiteLLM states the buyer and the job precisely, putting a full AI stack behind one key so spend is visible and capped before it runs, and named practitioners at NVIDIA, Netflix and Okta describe the same friction in their own words. Those quotes sit on the vendor's own page, and the quantified outcome claim, AT&T's report that the costs of some advanced AI tasks fell by as much as 56 percent, reaches a reader the same way. The pain is documented at a named buyer and not independently quantified, which is rung 3. [s1, s17, s3] |
| Capability Depth How specific the technical capabilities are, with evidence beyond marketing claims such as docs and third-party validation. | 5/5 | LiteLLM is an open-source AI gateway under the MIT licence outside its enterprise directory, offering one interface to more than 100 providers with virtual keys, spend tracking, guardrails and load balancing. Independent measurement shows unusually broad adoption of that implementation: Wiz reports LiteLLM in 36 percent of cloud environments, and Trend Micro reports that DSPy, MLflow, CrewAI and dozens of other frameworks pull it as a dependency. Widely adopted open source implementing the scored capability meets rung 5. [s3, s20, s4, s11, s12] |
| Market Timing Whether the market is ready for this product, with evidence that buyers are actively seeking solutions. | 3/5 | Buyer-side demand shows up as adoption, and in volume: Pfizer describes running the gateway for every team, application and agent, practitioners at NVIDIA, Netflix, Okta and AT&T are quoted using it, and Trend Micro reports the package at 3.4 million downloads a day. Those are two measures of one signal kind. The record carries no analyst category note, no budget-line movement and no regulatory driver aimed at buyers of this category, so it falls short of the multiple distinct kinds rung 4 requires. LiteLLM still addresses enterprise access to many models at once. [s17, s1, s12, s9] |
| Team Credibility Demonstrated domain expertise with public signals such as prior exits, publications, and industry recognition. | 3/5 | Krrish Dholakia and Ishaan Jaffer co-founded BerriAI, took it through Y Combinator's Winter 2023 batch, and built the gateway the repository records at 59,313 stars and 11,638 forks. Economic Times reports that Dholakia was a product manager at Microsoft, that Jaffer came from Coinbase, and that Berri AI's BetterShot adds error monitoring to LLM applications. That is documented prior employment plus one named in-domain build. Neither prior role names a product either founder led, and the reviewed sources carry no exit and no independent recognition, so rung 4's plurality is unmet. [s9, s10, s4, s5] |
| GTM Proof Evidence of actual traction (customers, revenue signals, partnerships) beyond stated intentions. | 5/5 | Adoption is measured independently of BerriAI. Wiz reports LiteLLM present in 36 percent of cloud environments, and Trend Micro reports about 3.4 million package downloads a day, with tens of thousands of developers and pipelines depending on it. BerriAI also names production users including NVIDIA, Netflix, Okta and AT&T on its own pages, which are its voice. Independently reported customer-scale evidence meets rung 5, though revenue remains undisclosed. [s11, s12, s1] |
| Funding Efficiency Whether funding matches go-to-market ambition, with signs of capital-efficient growth. | 4/5 | Disclosed capital in the record is one 1.6 million dollar seed from Y Combinator, Gravity Fund and Pioneer Fund, which Economic Times covered as planned in August 2023. Against it sit a repository at 59,313 stars and 11,638 forks, a Rust rewrite with a published benchmark harness, an enterprise tier carrying 24/7 response-time SLAs, a completed SOC 2 Type 2 report, and the 3.4 million package downloads a day Trend Micro reports. That is the visibly lean shipping at scale rung 4 names, multiply evidenced. No revenue, margin or later round appears, so rung 5 is out of reach. [s9, s10, s4, s18, s2, s8, s12] |
| Category Clarity Whether the company creates or fits a recognizable category that buyers can quickly place in their stack. | 3/5 | The AI gateway label travels beyond the vendor. Trend Micro's analysis of the March 2026 compromise frames LiteLLM as an AI gateway and treats AI proxy services as a class, and the NVD record for CVE-2026-59822 describes LiteLLM as a proxy server and AI gateway. LiteLLM benchmarks itself against Portkey and Bifrost, which places a peer set a buyer can compare against. The record carries no analyst category report and no buyer-side placement beyond those write-ups, so the category is recognisable without being independently established. [s12, s13, s18] |
| Incumbent Defensibility How vulnerable the core value proposition is to absorption as a feature by a platform vendor. | 3/5 | The gateway holds the virtual keys, per-team budgets, routing rules and guardrail configuration a replacement would have to reproduce, and at Pfizer it is the single API every team, application and agent goes through, which is real friction against absorption. No retained dataset, content licence or granted patent appears in the cited sources, so customer configuration and adoption are the demonstrated switching friction. That sits above the replicable-checkbox floor and short of the structural moat rung 4 describes. [s1, s17, s20, s19] |
BerriAI sells to the platform teams that have to give many developers, applications and agents access to many models at once. LiteLLM states the job as putting a full AI stack behind one key, seeing who drives spend, capping it before it runs, and sending each request to the model that should handle it. The product presents 140-plus providers and 1,892 models through one OpenAI-compatible interface, so an application can add or swap a model without changing code.
Buyers describe the same friction in their own words. An NVIDIA product lead says LiteLLM gives NVIDIA engineers a single, consistent way to reach more than 100 AI model endpoints across cloud providers, open-source deployments and internal NVIDIA services. A Netflix staff engineer says it lets his team offer new models usually within a day of release. An Okta architect says switching the backend model becomes a configuration update rather than a new procurement cycle and security review. Those quotes sit on LiteLLM's own page.
One deployment is described from the customer's side. A joint engineering post says Pfizer runs LiteLLM as a self-hosted AI gateway, a single OpenAI-compatible API in front of a multi-provider model catalog, serving every team, application and agent at Pfizer with uniform access to external and self-hosted models. [s1, s17, s3]
LiteLLM ships as an open-source Python SDK and a proxy server that stands in front of the model providers. The README describes one unified interface to call 100-plus providers in the OpenAI format, and the product attributes every request automatically and gives each team a virtual key with a hard budget, so requests stop when a key hits its cap and a runaway job or a leaked key cannot quietly run up the bill.
Security controls run inside the gateway rather than beside it. The guardrails quick start walks through prompt-injection detection and PII masking on the proxy, and the enterprise tier adds SSO, SCIM, OIDC and JWT auth, secret managers, key rotation, RBAC, audit logs and air-gapped deployment. On the supply side the homepage describes Cosign-signed, hardened non-root images, and the data-security page reports the Grype scan on built images passing with no high or critical severity findings.
The code is the validation a buyer can inspect. The repository carries 59,313 stars and 11,638 forks, the LICENSE places everything outside the enterprise directory under MIT, and a self-hosted deployment runs with no telemetry, so nothing about it returns to LiteLLM. The company has also published a Rust rewrite with a benchmark harness, AIGatewayBench, that measures gateway overhead across LiteLLM in Rust, LiteLLM in Python, Portkey and Bifrost; that comparison is the vendor's own measurement. [s3, s1, s19, s2, s5, s4, s20, s18]
LiteLLM competes as the open-source option against named commercial gateways. Its own benchmark harness measures the Rust proxy against Portkey and Bifrost, which is where the company places its competition, and the harness is published so a buyer can run it.
The position comes from standing in the path every model call takes, and from adoption, rather than from an asset a rival could not assemble. The gateway holds the virtual keys, per-team budgets, routing rules and guardrail configuration a replacement would have to reproduce, and at Pfizer it is the single entry point every team, application and agent goes through. The implementation outside the enterprise directory is MIT-licensed.
Independent researchers describe the same position from the attacker's side. Trend Micro's analysis of the March 2026 compromise says the campaign exposed how AI proxy services that concentrate API keys and cloud credentials become high-value collateral when supply chains fail. Sitting in front of every model call is what makes the product worth adopting and what makes it worth attacking. [s18, s17, s20, s12, s1]
BerriAI's visible motion starts with free adoption. The open-source proxy is self-serve from a repository created in July 2023 that now carries 59,313 stars and 11,638 forks, and Trend Micro, analysing the March 2026 compromise, describes the package as downloaded 3.4 million times a day.
Named enterprise use is the strongest conversion signal in the record. LiteLLM's homepage carries on-record quotes from named practitioners at NVIDIA, Netflix, Okta and AT&T, the joint engineering post describes Pfizer's self-hosted deployment, and the Y Combinator profile, written in the company's own first person, describes LiteLLM as trusted by companies like Rocket Money, Samsara, Lemonade and Adobe. The customer references appear on LiteLLM's homepage, a joint engineering post and Y Combinator's company profile.
Commercial scale stays undisclosed. The free tier carries the full provider coverage, virtual keys, budgets and guardrails, while the enterprise tier sells through a contact-sales motion with a 30-day trial key, and no revenue figure, paid-customer count or later round appears in the cited record. [s4, s12, s1, s17, s9, s2]
BerriAI's public team signal is the artifact and the accelerator. Krrish Dholakia and Ishaan Jaffer co-founded the company and took it through Y Combinator's Winter 2023 batch, and Economic Times reported both founders and the 1.6 million dollar raise in August 2023. The gateway they built is the evidence a reader can check directly: a repository created in July 2023 carrying 59,313 stars and 11,638 forks.
LiteLLM's data-security page names Krish Amit Dholakia as its signer, and the same page publishes a security contact and a vulnerability-reporting route.
The prior record is employment rather than founding. Economic Times reports that Dholakia had been a product manager at Microsoft and that Jaffer came from a role at Coinbase, and it names another Berri AI offering, BetterShot, which adds error monitoring to LLM applications. Neither prior role is tied to a product either founder led, and the reviewed sources establish no exit, sustained publication record or independent recognition. [s9, s10, s4, s5]
The March 2026 supply-chain attack is the defining trust event and the rest of 2026 added a second class of finding. Attackers published two malicious LiteLLM packages to PyPI. LiteLLM's own account puts them live from 10:39 UTC for about 40 minutes before PyPI quarantined them, while Wiz reports publication at approximately 8:30 UTC and quarantine at 11:25 UTC, a conflict the cited record leaves open. Wiz calls LiteLLM the latest victim of the TeamPCP campaign, and the company reported that customers running the official Docker image, which pins dependencies, were not impacted.
The product's own vulnerability record is now a matter of federal directive. CISA's Known Exploited Vulnerabilities catalog names BerriAI and LiteLLM three times: a SQL injection reaching the proxy database and the credentials it manages, added 2026-05-08 with a due date of 2026-05-11; a command injection letting any authenticated user run commands on the host, added 2026-06-08 with a due date of 2026-06-22; and an improper-authentication flaw in the MCP Streamable HTTP endpoint, added 2026-09-02 with a due date of 2026-09-16, which NVD scores 8.2 high.
The response is the other half of the record. BerriAI rebuilt its release pipeline, brought in Veria Labs to audit the proxy and fixed reports from independent researchers, announced a bug bounty program in April 2026, and committed to answering GitHub security advisories within five business days. Its data-security page still tells reporters the company does not currently offer a bug bounty, so the two pages disagree. Its updated SOC 2 Type 2 report, run with Vanta and validated by an independent auditor, became available through its trust centre in September 2026, alongside an enterprise tier that sells SOC 2 Type 2, ISO 27001, SSO and audit logs on a gateway the customer runs in its own infrastructure. [s6, s11, s14, s15, s16, s13, s7, s8, s2]
| Company | Relationship | Note | Compare |
|---|---|---|---|
| Portkey | competes with | Named in LiteLLM's published Rust gateway benchmark as one of the gateways it measured its own proxy against. | |
| Cloudflare AI Gateway | competes with | Competes for the same position in front of model providers. | |
| Kong | competes with | Competes for the same routing-and-governance position in front of model providers. | N/AWe scored these companies at different scopes, so the totals measure different things. |
| NeuralTrust | competes with | Competes for the same gateway-plus-guardrails position. | |
| Amazon Web Services | adjacent | Adjacent cloud platform in the same model-access path. | N/AAmazon Web Services is scored by product line, not as a whole company, so there is no company-wide column to compare. Open its profile to compare a specific product. |
Add analyzed competitors to compare them side by side with BerriAI.
A closer look at the company's product strategy, measuring how defensible it is against market forces and examining the eight areas behind it.
reinforce or reposition
What holds a BerriAI customer is the work sunk into its LiteLLM gateway. Pfizer's engineers describe it as the single API every team, application and agent goes through. Replacing it means repointing that traffic and reproducing the keys, budgets, routing rules and guardrails held in it. LiteLLM is open-source under MIT, and its guardrails include documented integrations beside a built-in filter. BerriAI holds a SOC 2 Type 2 report and ISO 27001. LiteLLM itself names Portkey and Bifrost as gateways in the same slot. Adoption is the head start rather than a durable lead.
| Dimension | Score | Rationale |
|---|---|---|
| Value Delivery Does the product sell software as the product, or judgment, trust, or accountability with software as the delivery mechanism. | 1/3 | LiteLLM is open-source software plus an enterprise edition, offered for self-hosting and as a hosted proxy, with BerriAI supplying code, release artifacts, response-time SLAs and support. Support is not a delivery layer that accepts accountability for the outcome, so customers pay for features and delivery sits at the software level. |
| Switching Cost How expensive leaving is for a customer: data portability, integrations, learned workflows, network effects, regulatory data residency. | 2/3 | Replacing the gateway means repointing traffic and reproducing the virtual keys, per-team budgets, routing rules and guardrail configuration held in it, and at Pfizer it is the single API every team, application and agent goes through. That is meaningful friction from integrations and learned workflows. The cited record does not size the migration, and the OpenAI-compatible interface is the same one a substitute would offer, so the score stays at 2. |
| Compliance Moat Whether certifications, liability acceptance, or audit trails block an easy replacement. | 1/3 | LiteLLM holds a SOC 2 Type 2 report validated by an independent auditor and available through its trust centre, and sells ISO 27001 alongside it. Both are attestations a funded competitor obtains through ordinary enterprise-market preparation, and the cited record documents no authorization regime, mandate or retained liability that would block a substitute, so this is entry cost rather than a moat. |
| Problem Complexity Whether the product requires ML, optimization, real-time systems, or years of specialized expertise. | 3/3 | Translating 140-plus providers into one OpenAI-shaped interface while running routing, load balancing, per-key budgets and, where a guardrail is switched on, pre-call and post-call screening of each model call at production latency is real-time distributed-systems work. The Rust rewrite and its benchmark harness, and the Redis configuration fault that cost about 48 percent of throughput in Pfizer's CI with no HTTP errors, both show the class of engineering involved. |
| Buyer Profile Whether buyers are SMB operators, mid-market IT teams, or regulated enterprises and governments with procurement gates. | 3/3 | Pfizer is the regulated-enterprise reference: Pfizer's platform engineers describe a production self-hosted deployment, and practitioners at NVIDIA, Netflix, Okta and AT&T are quoted using the gateway. The record does not separate free from paid use. The enterprise tier is sold through contact-sales with air-gapped deployment, 24/7 SLAs and marketplace procurement options, which is the procurement-gated motion this rung describes. |
| Layer Whether the product is an end-user application, a platform with application features, or infrastructure other applications depend on. | 3/3 | LiteLLM is the gateway applications and agents route through to reach any model rather than a plugin on a separate host platform. Pfizer's engineers describe it as the single OpenAI-compatible API in front of a multi-provider model catalog serving every team, application and agent, which is infrastructure the rest of an LLM stack depends on to function. |
| Proprietary Data, Content, or IP Whether the product accumulates datasets, content licenses, or IP that a rival cannot recreate from scratch. | 1/3 | No cited source names a retained dataset, content licence or granted patent. The guardrails documentation lists third-party integrations beside a built-in content filter, everything outside the enterprise directory carries the MIT licence, and the data-security page states that no data or telemetry reaches LiteLLM servers when a customer self-hosts, so the cited page reports that no data or telemetry is stored on LiteLLM servers for that path. |
BerriAI sells to the platform teams that hand many developers, applications and agents access to many models at once. LiteLLM puts a full AI stack behind one key and makes team spend visible before it runs. The enterprise page describes self-hosted or air-gapped access for hundreds of engineers.
The same codebase serves two adopter shapes. A developer can self-host the open-source proxy for nothing, with full provider coverage, virtual keys, budgets and guardrails. A larger organisation buys SSO, SCIM, RBAC, audit logs, key rotation and 24/7 support with response-time SLAs. That lets BerriAI land inside engineering and expand into the procurement-gated account without a second product.
Named demand includes Pfizer, NVIDIA, Netflix, Okta and AT&T. Pfizer's platform engineers describe running LiteLLM as a self-hosted gateway serving every team, application and agent with uniform access to external and self-hosted models, and practitioners at NVIDIA, Netflix, Okta and AT&T are quoted on LiteLLM's own page. How much of that adoption is the free proxy rather than the paid tier is not separated in the cited record.
LiteLLM presents 140-plus providers and 1,892 models through one OpenAI-compatible interface, so an application can add or swap a model without changing code. The proxy attributes every request automatically and gives each team a virtual key with a hard budget. When a key hits its cap, requests stop. This prevents a runaway job or leaked key from raising the bill.
Policy enforcement runs inside the gateway. The guardrails quick start walks through prompt-injection detection and PII masking on the proxy, and the enterprise tier adds SSO, SCIM, OIDC and JWT auth, secret managers, key rotation, RBAC and audit logs. On the supply side the company publishes Cosign-signed, hardened non-root images and reports a passing Grype scan with no high or critical severity findings.
BerriAI's current advantage is adoption and provider breadth rather than a model edge. The guardrails documentation lists third-party integrations such as Presidio, Aporia and Lakera beside a built-in LiteLLM content filter, everything outside the enterprise directory is MIT-licensed, and the data-security page states that no data or telemetry is stored on LiteLLM servers when a customer self-hosts. What a rival would still have to displace is the adoption already on the record: 59,313 stars and 11,638 forks on the repository, and 3.4 million package downloads a day as Trend Micro reported in March 2026.
BerriAI's visible motion starts with free adoption. The open-source proxy is self-serve from a repository created in July 2023 that carries 59,313 stars and 11,638 forks, and Trend Micro, analysing the March 2026 compromise, describes the package as downloaded 3.4 million times a day.
Named enterprise use is the strongest adoption signal in the cited record. LiteLLM's homepage carries on-record quotes from named practitioners at NVIDIA, Netflix, Okta and AT&T, a joint engineering post describes Pfizer's self-hosted deployment, and the Y Combinator profile, written in the company's own first person, describes LiteLLM as trusted by companies like Rocket Money, Samsara, Lemonade and Adobe. The customer references appear on LiteLLM's homepage, a joint engineering post and Y Combinator's company profile.
BerriAI reports a 1.6 million dollar seed from Y Combinator, Gravity Fund and Pioneer Fund, a financing Economic Times covered as planned in August 2023, and it sells the enterprise tier through a contact-sales motion with a 30-day trial key. No revenue figure, paid-customer count or later round appears in the cited record.
BerriAI publishes free and enterprise tiers. The open-source tier is free to self-host under MIT, and the enterprise page says it starts from the same gateway an organisation's engineers already run. The enterprise tier adds SSO, RBAC, audit logs, SCIM and support, and a buyer reaches it through a 30-day trial key or a sales conversation.
What the enterprise tier charges by stays private. The page invites a buyer to request pricing rather than naming a meter such as developers, projects, seats or request volume, which fits a negotiated deal sized to each organisation. The published-then-gated split tells a buyer the free proxy is meant to pull teams in before any sales conversation.
The belief the structure encodes is that organisations pay for governed access at scale rather than for the routing itself. The free tier already carries the routing and the guardrails, and the enterprise page offers air-gapped self-hosting, so what the enterprise tier prices is the governance around them: SSO and SCIM, OIDC and JWT auth, secret managers and key rotation, RBAC, audit logs and response-time SLAs.
LiteLLM delivers mostly as software the customer runs. A developer self-hosts the open-source proxy; a larger organisation runs the enterprise edition in its own infrastructure, including fully air-gapped, and the data-security page states that no data or telemetry reaches LiteLLM servers in that mode. A hosted path also exists: the README links a Hosted Proxy, and the March 2026 incident page lists LiteLLM Cloud users among those the compromise did not reach. The company lists AWS Marketplace and Azure Marketplace among procurement options.
The March 2026 supply-chain incident compromised the release pipeline. After the March 2026 supply-chain incident, BerriAI rebuilt releases on a CI/CD v2 pipeline. It added isolated environments, stronger security gates and safer release separation. The company points enterprises to the official Docker image, whose pinned dependencies spared customers during the attack. Vulnerability disclosures since then have shipped with published advisories, an external audit by Veria Labs and a bug bounty program.
A joint post with Pfizer's platform engineers shows what support looks like in practice. Pfizer's CI caught a roughly 48 percent throughput drop on a version bump, with no HTTP errors in the logs, which was enough to hold the version back from production, and the two teams traced it to a Redis configuration bug together. On the self-hosted paths BerriAI supplies code, release artifacts and enterprise support while the customer's own platform team operates the deployment.
The March 2026 supply-chain attack is the defining trust event. Attackers published two malicious LiteLLM packages to PyPI. LiteLLM's own account puts them live from 10:39 UTC for about 40 minutes before PyPI quarantined them, while Wiz reports publication at approximately 8:30 UTC and quarantine at 11:25 UTC, a conflict the cited record leaves open. Wiz calls LiteLLM the latest victim of the TeamPCP campaign, and the company reported that customers running the official Docker image, which pins dependencies, were not impacted. Trend Micro's analysis of the same campaign says it exposed how AI proxy services that concentrate API keys and cloud credentials become high-value collateral when supply chains fail.
The product's own vulnerability record is now a matter of federal directive. CISA's Known Exploited Vulnerabilities catalog names BerriAI and LiteLLM three times. The SQL injection reached the proxy database and its managed credentials, added 2026-05-08 with a 2026-05-11 due date. The command injection let authenticated users run host commands, added 2026-06-08 with a 2026-06-22 due date. The third was an improper-authentication flaw in the MCP Streamable HTTP endpoint, added 2026-09-02 with a 2026-09-16 due date. NVD scores it 8.2 high and records it as fixed in 1.84.0.
The response is the other half of the record. BerriAI brought in Veria Labs to audit the proxy, fixed reports from independent researchers, launched a bug bounty program in April 2026, and committed to answering GitHub security advisories within five business days. Its data-security page still tells reporters the company does not currently offer a bug bounty, so the two pages disagree. Its updated SOC 2 Type 2 report, run with Vanta and validated by an independent auditor, became available through its trust centre in September 2026, and the enterprise page sells SOC 2 Type 2, ISO 27001, SSO and audit logs on a gateway the customer runs itself.
These remain commercial attestations rather than a federal authorization, so a security review of a gateway that can centralize access to provider credentials and model traffic weighs them alongside the open code, the disclosure record and the enterprise controls.
LiteLLM is itself the gateway applications and agents route through to reach any model, not a plugin on someone else's platform. Pfizer's engineers describe it as a single OpenAI-compatible API in front of a multi-provider model catalog, serving every team, application and agent, which is infrastructure the rest of an organisation's LLM stack depends on to function.
That position is the source of both the friction and the exposure. Replacing the gateway means repointing traffic and reproducing its virtual keys, budgets, routing rules and guardrail configuration. The cited record documents no completed migration. Its OpenAI-compatible interface may ease a move to another compatible gateway.
The exposure is that the same interface is easy for others to offer. LiteLLM's own benchmark harness measures its Rust proxy against Portkey and Bifrost, so the company itself places named substitutes in the same slot, and everything outside the enterprise directory carries the MIT licence a competitor can read and fork.
BerriAI's credibility comes from two founders who built widely used infrastructure. Krrish Dholakia and Ishaan Jaffer co-founded the company, took it through Y Combinator's Winter 2023 batch, and grew LiteLLM into an open-source gateway that the repository records at 59,313 stars and 11,638 forks since its creation in July 2023.
The funding and accelerator signal is real and early. The company reports a 1.6 million dollar seed from Y Combinator, Gravity Fund and Pioneer Fund, which Economic Times covered as planned in August 2023, and no later round appears in the cited record. LiteLLM's data-security page names Krish Amit Dholakia as its signer and publishes a security contact and a vulnerability-reporting route.
The prior record is employment rather than founding. Economic Times reports that Dholakia had been a product manager at Microsoft and that Jaffer came from a role at Coinbase, and it names another Berri AI offering, BetterShot, which adds error monitoring to LLM applications.
| Id | Source | Tier | Accessed |
|---|---|---|---|
| f1 | LiteLLM homepage: AI gateway for 140+ providers | official | 2026-09-21 |
| f2 | Y Combinator LiteLLM company page (founding year, batch) | other | 2026-09-21 |
| f3 | LiteLLM AI Gateway company page on LinkedIn (About, Headquarters) | official | 2026-07-31 |
| f4 | AI Defense Matrix Catalog entry | other | 2026-06-09 |
| f5 | AI Defense Matrix Catalog mapping | other | 2026-06-23 |
This site is an experimental research aid created by Zeltser Security Corp. All its data gathering and analysis was performed autonomously without human review, and it can contain errors of fact, interpretation, and judgment that a human reviewer might catch.
The analyses are statements of opinion, not statements of fact. Machine analysis produced the scores, summaries, and matrix placements by weighing the public sources each page cites, and reasonable people can weigh the same sources differently. Where a page states a fact, it cites the public source and the date it was checked, and the statement is only as accurate as that source. Unless a profile expressly says otherwise, the analysis involves no hands-on testing and no independent validation of any company's products or services.
Nothing here is professional, security, legal, financial, investment, or purchasing advice, and nothing here is a recommendation to invest in, do business with, or avoid any company. Inclusion of a company is not an endorsement, and absence of a company is not a judgment about it. Reading this site creates no advisory or client relationship. Verify any detail you plan to act on against the vendor's current materials.
The content is provided "as is" and "as available," with all warranties disclaimed, express or implied, including merchantability, fitness for a particular purpose, accuracy, and non-infringement. No entry is warranted to be complete, current, or correct. Companies change, vendors update their claims, sources can be wrong, and automated analysis can misread them.
To the fullest extent permitted by law, the operator, Zeltser Security Corp, is not liable for any damages that arise from using this site or relying on its content, including direct, indirect, incidental, special, and consequential damages and lost profits, even if advised that such damages were possible. If you are dissatisfied with the site or disagree with these terms, your remedy is to stop using it.
Entries link to vendor pages, press coverage, and other external sites that Zeltser Security Corp does not control and is not responsible for. A link is not an affiliation with the destination or an endorsement of it. Product and company names and trademarks are the property of their owners, used here nominatively to identify the companies described. Short quotations from cited sources appear for identification and commentary.
Use, quotation, automated retrieval, and redistribution of the content are governed by the Terms of Use at cybercompanyprofiles.com/terms, which permit personal and internal business use with attribution and prohibit republication and resale.