Comment by detente18

Hi threecheese,

Pinning is a good idea.

So far, we believe it came from the github oauth cli tokens which are embedded in claude code tool responses - https://docs.litellm.ai/blog/security-incident-oct-21-2026#g...

It's something we're still investigating. I'll update my thread on this post, as we learn more!