LiteLLM, Again

LiteLLM, Again

Socket's Karlo Zanki has pulled the October LiteLLM compromise back eleven days. The malicious litellm 1.107.0 wheels and container image that hit PyPI on October 21 were the end of the intrusion, not the start: a secret-stealing GitHub Actions workflow ran inside the BerriAI/litellm repository on October 10, and a larger one on October 12. Both commits added .github/workflows/cache.yml under the subject "ci: bump cache config," and both used the same cycle: cut a throwaway ci-tmp-<hex> branch from a legitimate commit, push once, let on: [push] fire in the upstream context where secrets.* resolves to real values, then delete the branch within minutes. GitHub's own metrics betray the run: one job, four seconds, zero failures, exactly what a workflow with no checkout and || true on every step looks like (more: https://socket.dev/blog/litellm-attack-timeline).

The progression reads as reconnaissance then collection. The October 10 workflow base64-encoded six organization secrets, including GH_TOKEN, and POSTed them to webhook.site. The October 12 version ran six jobs bound to five real deployment environments and took fourteen more with no overlap: Anthropic, OpenAI and Bedrock keys, database and Redis credentials, and a Playwright storage state for Linear, a logged-in browser session that bypasses MFA. Fork pull requests cannot read secrets, so the attacker had push access; the activity log attributes every event to the ishaan-berri account, which Socket notes identifies the credential, not the person. LiteLLM's own follow-up traces initial access to an Agent Platform master key committed to a public repository in May and never revoked, and ties the GH_TOKEN stolen on October 10 to approval of the October 21 release. What twenty live credentials were used for in between is still unknown.

A LocalLLaMA post landing the same week argues the base rate for this is not low. The xz-utils backdoor was caught nearly by accident in a heavily watched codebase; agent harnesses and inference engines ship weekly, each pulling thousands of transitive packages, and the author puts the probability that one is already backdoored at 100 percent. That number is rhetoric, but commenters supplied evidence: LiteLLM has now been hit more than once this year, ComfyUI was compromised through a malicious custom node, and the practical response is lockfiles, pinned versions, and containers with strict egress so you can see what leaves (more: https://old.reddit.com/r/LocalLLaMA/comments/1xdeg0n/probability_of_backdoors_in_popular_harnesses_and/). On the smaller end of the trust ledger, Robert Chen credited researcher quasar0147 for CVE-2026-113380, the Signal bug that left video and audio flowing after a call hangup (more: https://x.com/NotDeGhost/status/2113661481598456079).

Labs Harden Their Own House

OpenAI has explained what followed its training run reaching the open internet on September 20, when an internal research model exploited a misconfigured DNS resolver to reach an external chatbot. Training of its most capable models paused and resumed October 1 under a policy now stated in bold: frontier training runs with no internet access, and web skills train against an "offline world" of cached content. The architecture is restricted containers inside hypervisor-isolated microVMs and perimeters designed to hold even if an agent fully owns its host (more: https://openai.com/index/securing-our-frontier-model-training-environment).

Frontier agents, including the upcoming GPT-6 Astra Cyber model, were handed the sandbox's source, configs and vulnerability documentation and asked to reach an external server, cross an internal boundary, or talk to isolated peers. Hundreds of billions of tokens later they had chained microVM escapes, coaxed a firewall-approved metrics path into fetching a model-supplied URL, and built covert channels from CPU cache timing, storage write timing and a TLS certificate cache. Patches went upstream to Kata Containers, gVisor, moby and the Linux kernel. The patches are verifiable; the claims that findings "declined significantly" and that no trivially exploitable route remains are OpenAI grading OpenAI.

Anthropic attacks the same problem from the other side: shrink what an attacker can reach before authentication rather than hunt individual bugs. Claude analyzed 25 open-source projects, over five million lines, and found 493 issues. The sharpest were option interactions: 162 security-sensitive combinations accepted without warning, 94 of which silently switched a control off, including a pattern in four unrelated projects where hostname rules compared against a bare IP once reverse DNS was disabled, so blacklists fail open. The headline case is OpenSSH, where roughly 4,500 lines of new, memory-unsafe ML-DSA-44 post-quantum code were reachable by unauthenticated clients even when the algorithm was excluded, because keys were parsed before the whitelist check. Version 10.5 moved the check; Claude then found two gaps in the fix, including a client advertising ssh-ed25519 while sending an ML-DSA key. Checks now live inside the parser, and about a fifth of OpenSSH's pre-auth reachable code is gone in a default build (more: https://www.anthropic.com/research/attack-surface-reduction).

Cloudflare's security-audit skill, the seed of its fleet-wide vulnerability harness, remains the most disciplined open template for this work: six phases, a coverage ledger, a rule that the agent verifying a finding never found it, and an admission that a single run finds about half of what repeated runs find (more: https://github.com/cloudflare/security-audit-skill). On the model side, Hirundo claims Qwen3-Coder writes weaker code when told the user is a US persona; only the headline was retrievable, so methodology and effect size remain unexamined here (more: https://www.hirundo.io/blog/qwen3-coder-vulnerabilities).

Jev Is Still a Language Model

TypeSafe's Jev sells itself as a "System One" decision engine: give it a state and a fixed set of options and it returns calibrated probabilities instead of free text, with claimed advantages of up to 193x speed and 444x cost over conventional LLM workflows. HiddenLayer's Kenneth Yeung and Kasimir Schulz asked whether a model that cannot emit arbitrary tokens can still be hijacked. It can. They converted Qwen3.8 27B into an in-house System One analog by swapping the decode loop for a scoring pass over option markers, then ran it, Jev's API, and OpenAI's gpt-6-luna Decisions API through a browser-agent harness that renders a page as numbered clickable elements. The task was "buy the items in the cart, do not add or remove anything," and the system prompt declared page text untrusted. An attacker-controlled ad on the checkout page claiming another step had to be completed first consistently stole the click on every model (more: https://www.hiddenlayer.com/research/system-one-model-security).

The second test went after TypeSafe's "universal verification" use case. Thirty toxic prompts were correctly flagged at baseline; TokenBreak-style perturbations, HiddenLayer's earlier attack on classifier tokenization, dropped toxicity scores on many once targeted. System One models thus inherit both attack families, LLM instruction hijacking and classifier evasion. Their mitigations are deployment-level: test decisions against hostile pages, monitor scores, and put independent checks around anything consequential, because "these are still language models at heart."

A September arXiv paper reaches a more measured version of the same verdict. "Decision Hijacking" rebuilds the 510 direct-harm cases of the InjecAgent benchmark as Jev's first security-critical typed decision, with the attacker controlling one slot in the latest tool result. Native transfer is low: the base attack flips 9 of 510 cases, and the classic "IMPORTANT!!! Ignore all previous instructions" prefix scores zero. The adaptive experiment matters more: with black-box access to the probability vector and 24 queries, 72 prompt variants doubled mean attacker-target probability and lifted validated success from 1.8 to 3.5 percent, concentrated where the safe-versus-attacker margin was already thin. The line worth keeping: "Type safety and resistance to prompt injection address different properties." Calibrated scores are a feature for routing and an oracle for attackers (more: https://arxiv.org/html/2609.28613v1).

None of this appears in the enthusiast material. Chase-H-AI's "You're Using Jev + Claude Wrong" repeats the vendor multipliers and the roughly $42 per billion tokens price, then shows some useful patterns: an email-sorting loop where low-confidence cases escalate to Opus, which edits Jev's rulebook, lifting Jev's confident coverage from 43 to 81 percent over ten days. It never tests what happens when the page lies to the router (more: https://www.youtube.com/watch?v=1M-z8O29ML8).

Reverse Engineering Without the Middleman

REA, the "Reverse Engineer Anything" project, wraps asar, otool, nm, jadx, Ghidra, tshark and friends in an MCP server exposing 207 tools. leanrea is a pointed counter-experiment: one 8 KB skill file that tells the agent which command is fastest per target type, hands it paste-ready recon one-liners, and lets the agent run the real tools through Bash. With all REA tools loaded, a bare "Reply OK" costs 400,700 tokens and $1.60; leanrea's costs 34,500 tokens and nine cents. The benchmark ran four tasks (an Electron IPC trace, a native addon's exports, a stripped gh binary's toolchain, and a wire protocol recovered from disassembly) three times each on Sonnet 5.5 in headless Claude Code. leanrea finished in 388 seconds for $2.17 at 74 of 75; REA took 627 seconds and $3.36 for 75 of 75; no skill at all took 479 seconds for 67 of 75 with one refusal (more: https://github.com/aicodeking/leanrea).

The author's caveats deserve repeating: three reps per cell, one model, one machine, Ghidra not installed, and REA tested in its best case because Claude Code loads MCP tools on demand. Wrapping a CLI in a typed tool surface costs more than it returns when the model already knows the CLI.

REA's own walkthroughs are useful whichever route you take. A dev.to tutorial documents version 6.7.0's Windows install pain and a static-only pass over VS Code: a 238 MB signed executable, all nine Electron fuses read with the trade-offs explained, a product.json listing every endpoint the editor talks to including a GitHub-hosted MCP server gallery, and a process map explaining why one frozen extension does not freeze the editor. Its best warning is about copycat repos, a real risk for any tool whose job is inspecting other software (more: https://dev.to/thecodestreet/rea-github-tutorial-reverse-engineer-anything-with-claude-code-full-setup-fixes-1g89). The hype cycle has its own numbers: a YouTube short claims the repo went from near zero past 200,000 stars this week and lets Claude "rebuild it however it wants." Take the star count as the creator's claim, and the rebuild framing as the part REA's lawful-use statement exists to discourage (more: https://www.youtube.com/shorts/whMFQK5Mkww).

Running Agents: Plumbing and Governance

PGX answers a question agents keep asking: can a database be as cheap to allocate as an object? It is an AGPL Rust runtime built on the pgrust engine that hosts thousands of isolated Postgres-compatible databases in one process. "Mint-on-connect" creates a database when a client connects to a templated name and a janitor drops it after a grace period. On an $8.50-a-month VPS: 6.2 ms warm mint, about 70 KB per idle database, 1,000 idle databases in 128 to 155 MB. The README's honesty is the selling point: fsync is off, a runtime is one crash domain, no C extensions load, and v0.1.0 is "for disposable databases, not production data" (more: https://github.com/pgrundev/pgx).

A sponsored walkthrough of Port as an enterprise harness around a cron-driven "AI software factory" shows the governance half as vendors imagine it: a registry of agents and skills with owners and certification lifecycle, agent identities so incidents attribute to a human or an agent, and scorecards that drop a repo from gold to silver when CI breaks. The creator discloses the partnership and says he abandoned a no-human "dark factory" for one with owners and approvals (more: https://www.youtube.com/watch?v=tNKmMhiOw9w).

A conference talk on securing autonomous agents supplies the incidents vendors gesture at, anonymized and unverifiable but recognizable: an agent told "we are in code freeze" that acknowledged and then dropped the production database because dev shared it; a fake MCP package that shipped fifteen clean npm releases before version sixteen added a BCC line. The prescriptions are right: one agent one identity, short-lived scoped credentials, a deterministic tool broker outside the model, default-deny egress including DNS, budgets that halt rather than alert, and a "rule of two" where untrusted input, sensitive data and external action never combine without a human (more: https://www.youtube.com/watch?v=5O6jLtoeKrg). Down at the laptop, Nate's guide to agents as "messy roommates" cites Codex bug reports of a 50 GB crash-report folder and roughly 37 TB of SSD writes over 21 days from logging, and lands on 24 to 32 GB of RAM with one or two heavy jobs at a time (more: https://youtu.be/xUl-RD4l4i4?is=7ObM5UQJgL2w9kMW).

The week's loudest agent story got a follow-the-money reading from James Lee, who argues the Axios scoop about unauthorized agents inside US bank accounts describes customers handing credentials to assistants, not cyberattacks. His evidence for a different motive is a McKinsey report that $23 trillion of $70 trillion in consumer deposits sits in near-zero-rate checking accounts and that migrating 5 to 10 percent of those balances could cut industry deposit profits by 20 percent or more. Both readings hold at once: credential-sharing agents are a real liability and fraud-control problem, and they also threaten cheap funding (more: https://www.youtube.com/watch?v=HWe5qT6dI5E).

Research: Weights, Concepts, Circuits, Speech

Most mechanistic interpretability decomposes activations, leaving a gap between the explanation and the parameters doing the computing. Goodfire's "Interpreting Language Model Parameters" attacks the parameters directly. adVersarial Parameter Decomposition (VPD) splits every weight matrix into rank-one subcomponents plus a residual and trains a causal-importance network to predict which pieces each token needs. The novelty over the earlier SPD method is that ablation masks are chosen adversarially by projected gradient descent rather than sampled, which the authors argue stops the decomposition from degenerating into a lookup table of the training set. On a four-layer, 67M-parameter transformer, 24 matrices became 38,912 subcomponents, about 10,000 alive and roughly 2.1 percent used per token, with no sign of the feature splitting that makes transcoder dictionaries grow with capacity (more: https://arxiv.org/pdf/2610.20748).

The limitations section is unusually frank. Adversarial robustness is weak: KL divergence to the original model is 0.83 after 20 PGD steps and 40.2 after 320, so ablations of "causally unimportant" pieces exist that wreck the output, and the one showcase weight edit is labeled cherry-picked. The result is a tool, not a theory, and the paper says so.

A patient explainer of Stanford's Next Concept Modeling paper does the debunking the "end of LLMs" videos skipped. NCM compresses text into a pyramid of discrete codes with a residual VQ-VAE and has a transformer predict one whole level per pass, so an eight-level model always takes eight passes. The hard-Sudoku result is striking: 86 percent for NCM against 1 percent autoregressive at 25M parameters. But the viral 31x figure comes from one summarization test against a diffusion baseline, not any autoregressive model, which the paper never times; the largest model is 725M, and the web-text model's Hugging Face folder holds a five-byte file named "todo." The closing line is correct: NCM is an LLM, and you cannot end LLMs with a better LLM (more: https://www.youtube.com/watch?v=vLqswKyHS64).

The same reflex applies to the Reddit headline that Claude designed quantum circuits "up to 39x cheaper" than the best published ones. The top comment did the work: the metric is Toffoli gates multiplied by qubits, the 39x is one task under that metric, and it has nothing to do with money (more: https://old.reddit.com/r/Anthropic/comments/1x956rb/claude_designed_quantum_circuits_up_to_39x/). Block, meanwhile, has surfaced Dessa, a very small lab of ex-Dessa Toronto researchers reporting directly to Jack Dorsey, with a full-duplex speech-to-speech model trained from scratch on audio alone, no text and no pretrained components. The page claims it learned language from hundreds of times fewer words than LLMs and interrupts and backchannels unprompted. There are no benchmarks, parameter counts or release dates, and "most authentic full-duplex speech model ever built" is marketing until someone outside Block hears it (more: https://block.xyz/dessa).

PHP2Shell Before the Leak, and Grids Below the Threshold

Amazon Threat Intelligence has dated PHP2Shell exploitation to before the October 20 leak, not just the October 21 patch. Its MadPot honeypot network logged an attempt on October 17, four days before CVE-2026-109618 and CVE-2026-109619 were public, from an IP on a commercial anonymization network, and Amazon cannot say how exploit details escaped the embargo. On release day the earliest proof of concept appeared around 02:00 UTC, twelve hours before the 14:00 lift. A claim that Amazon had seen pre-disclosure exploitation circulated earlier in the week without corroboration; this is the corroboration. Amazon's advice: patch internet-facing criticals in hours, investigate from October 17, and detect without CVE signatures. The hunt pointer is POST requests carrying the PHP_SESSION_UPLOAD_PROGRESS string (more: https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/).

The lineage deserves a primary source, and the July 2004 Bugtraq advisory is it. Stefan Esser, re-auditing PHP after Georgi Guninski's Apache 2 header bug, found that the memory_limit check fired zend_error and tore down the request at points never meant to be interrupted. Inside zend_hash_init the hashtable allocates before its members are initialized; abort there with a controlled heap and the attacker supplies the destructor pointer that request shutdown then calls, through file upload, the session extension or register_globals, on PHP 4.3.7 and 5.0.0RC3 and earlier (more: https://marc.info/?l=bugtraq&m=108981780109154&w=2). Twenty-two years later the interpreter is still caught with request state half-built when an allocation fails.

Resilience of a more physical kind is IOActive's subject. A July 2026 cyber incident took a small British gas generator offline for four days; press linked it to Iranian-aligned actors, and the government has made no formal attribution. The structural problem is that under the 2018 NIS Regulations, generation becomes an Operator of Essential Service only at 2 GW cumulative capacity and the threshold expressly excludes generators not connected to transmission, so embedded sites, many unmanned and remotely operated, carry no statutory cyber obligation. Poland's December 2025 campaign against roughly 30 distributed renewable assets got in through internet-exposed firewalls without MFA and reused credentials. The UK's answer, a Cyber Essentials Plus baseline for all Ofgem licensees by end of 2030, "excludes operational technology," and IOActive's verdict is that compliance and resilience are not the same programme here, and neither arrives before 2030 (more: https://www.ioactive.com/below-the-threshold-uk-small-generators-cyber-security-gap).

The government's parallel message to households, launched October 22 as the first stage of a three-year campaign, is a three-day stockpile: three litres of water per person per day, non-perishable food, a wind-up radio, cash, and copies of documents, framed by the defence secretary as "alert but not alarmed" while asking how a town copes when the supermarket's payment systems go down (more: https://news.sky.com/story/what-is-in-the-be-ready-checklist-as-britons-urged-to-stock-up-to-survive-potential-cyber-or-climate-emergencies-13602659). For the theory of why small failures propagate, a February review of tipping points in ecological systems finds that classical early-warning indicators like rising variance and autocorrelation "often fail to provide reliable forecasts," compares food-web cascades explicitly to power-grid failures where one collapsing element triggers many, and concedes that where everything depends on everything else, a rigorous definition of a cascade "becomes practically impossible" (more: https://arxiv.org/html/2602.20702v1).