The Whistle: LiteLLM's poisoned release train, hacker panels left open, and OpenAI lands on Google Cloud

The release pipeline of LiteLLM, the model-gateway library, was emptied with three engineers’ stolen GitHub tokens. The operators of an open-source AI pentest platform left their control panels answering on the open internet, complete with target lists and API keys. The platforms that hold agent secrets for a living spent the week telling everyone to rotate everything. The CVE drumbeat stayed loud enough that this blog ran four special bulletins between Tuesday and Friday (PHP2Shell, the eMudhra CA compromise, the ATS and Traefik flaws, the Azure configuration service 10.0, VeloCloud and Collabora), so the vulnerability list lives there; this weekly holds the stories. Security leads below, then the cloud and model news: an ingress gateway for ECS, a security read on last week’s Lambda Web Functions launch, native PyTorch backends for both Trainium and TPU, rivals’ models landing on Google Cloud, Python 3.15, TypeScript in Rust, and three new model entries closing the week.

Security: LiteLLM’s release pipeline got emptied with its own tokens

The best documented incident of the week is also the one with the most uncomfortable mechanism. LiteLLM disclosed on October 21 (the Register’s account is the quicker read) that at 4:00 AM PST its release pipeline was compromised and version 1.107.0 was pushed to PyPI, Docker Hub and GHCR with compiled malware inside: a credential stealer plus the infrastructure to load and run remote code on victim machines. The attacker got in through three engineers’ GitHub accounts using stolen GitHub CLI OAuth tokens. One account made the changes to the release pipeline and triggered the release run. A second account approved it. That detail should end any confidence you have that a two-person release approval is a control: the approver’s session is a token too, and this attacker held both tokens. Blast radius is precise and small: unpinned pip installs of LiteLLM between 11:39 and 13:23 UTC, and docker tags v1.107.0, latest, main-latest and main-stable pulled between 11:46 and 14:20 UTC, everything on October 21. The official v1.107.0 source tag on GitHub is clean; the malicious artifacts were built from an attacker-controlled repository, so the build and publish machinery was the attack surface, not the code. If you ran any of it in those windows, the incident notes’ first line of guidance is the one worth memorizing: do not start with pip install, because the package’s persistence (a sitecustomize.py hook) runs on every Python start in the environment, pip included. Treat DATABASE_URL values as burned, audit for unexpected GetCallerIdentity calls, and pin to 1.106.2. LiteLLM revoked the involved tokens, gutted its GitHub org down to one unaffected user, and scrubbed the trusted-publisher links from the public registries. And the honest part of their incident page: at last update they still could not say how the tokens were taken in the first place. Enterprise customers on the private registry were not touched.

Security: an AI-hacker operation left its control panels open

A week after the CyberXero profile gave us the broker’s workstation leak, the operational middle management turned up in bulk. NorForge’s research mapped more than 20 publicly exposed control panels for Cairn, an open-source AI platform that describes itself as a “general-purpose problem-solving engine”: give it a target and an objective and it coordinates agents to investigate, find weaknesses, and break in. The panels were discovered by routine Shodan and Censys searches, and the operator side is all on display: target lists, discovered weaknesses, account secrets and API keys, and which targets were already compromised. The Verge’s report, following Reuters, states that the most active operator broke into more than 100 websites across the US, Canada, Australia and Japan, with victims including John Deere, SharkNinja and Cummins. The company statements are mild: John Deere says there is no indication sensitive information was accessed, SharkNinja says a standalone product-support site was contained, and Cummins is investigating a website operated by one of its third-party vendors. The operator’s preferred intrusion tactics fit in fewer than 100 Chinese characters, and successful breaches took about 23 hours. NorForge also found legitimate red team operations exposed the same way, which puts their clients at risk. Cairn’s creator (@le1xia0) responded that the platform “was never a ‘hacking tool’” and that “misuse is a human decision, not a feature of the engine.” Both halves of that sentence are true and neither is a defense plan. Every agent framework with a web UI is an appliance with a login page, and if yours is answering without authentication, its history of what you pointed it at is public reading.

Security: the platforms that hold your secrets had a week

Railway, the developer platform, confirmed Wednesday (October 21) that a cyberattack let attackers access some encrypted environment variables and, for some of them, obtain the decrypted contents, then urged all users to revoke and rotate their API and cloud keys while its own analysis suggests a subset of users was affected. No root cause given, builds paused briefly and restored, and founder Jake Cooper told TechCrunch a post-mortem will follow. Railway framed the incident as part of a broader attack targeting platforms “with the aim of compromising AI inference providers.” OpenCode, the open-source AI coding tool, disclosed earlier in the week that exposed API keys belonged to about 1.4% of its console users with external providers linked, attributing it to an AI distillation attack, agents seeking to extract sensitive information from AI models, against the backdrop of CISA’s warning that China-based AI companies are attacking US companies to improve their own models. And PingCAP (TiDB) disclosed attackers using stolen service-account credentials from September 9 to October 7, copying data and source code (Dark Reading’s account includes FulcrumSec’s claims of customer metadata and API keys riding along). Three different operators, one shape: the thing that stores credentials on behalf of builders is now the target of choice, because one compromise fans out to every key it holds. Bake the assumption in: someday a platform in your dependency tree will discover this, tell you with no root cause and a “subset of users” figure, and the rotation you skipped last quarter will be the one that matters.

Security: AWS’s leaked-key quarantine is not revocation

Truffle Security audited what actually happens when AWS detects one of your keys in the wild: AWS Key Quarantine is Not Revocation. AWS attaches a quarantine policy to the IAM user that owns the key. The key itself stays enabled. The deny lists across all three policy generations (2020’s original, 2021’s V2, 2024’s V3) block launching EC2 instances and creating new access keys; retrieving secrets from existing infrastructure, running commands through SSM on existing servers, and deleting databases or backups are not blocked at all unless the specific generation includes them. In their dataset, 894 exposed keys carried a quarantine and retained grants for dangerous actions; 738 ran with the older policy and never picked up V3’s restrictions, and V2 and V3 have both been revised in place under the same names, so attaching a policy is not a version guarantee. Read the quarantine as a bandage AWS applies without telling you the key is still armed. The rotation you do yourself remains the only control that actually ends the exposure, and if your exposure response plan says “AWS will catch leaked keys,” this post is the argument for revisiting it.

Security: Meta’s Muse share links are findable on purpose

Meta’s consumer agent Muse lets users share conversations as web links, and a Meta design decision made those links enumerable: Claroc’s research (reported Monday, Ars Technica’s account is the summary) found 6,800 Muse share links through passive DNS, because conversation titles ride in the subdomains. Opening a few hundred produced exactly what you would fear: a candidate’s prep notes for a confidential executive-search call with a frontier AI lab, including the lab’s internal contact and meeting time; a marketing company’s internal revenue review marked for its CEO; a small-business loan application with the amount; a to-do list with a bank fraud alert, a partial account number, and a transaction amount; a real-estate investor’s internal performance report with two property addresses and return figures; and a workplace’s full-year vacation calendar with dozens of named employees. The researchers’ own line: “If you had asked us beforehand, we would have guessed that gathering these would take real effort… It took one query.” Claroc says the enumeration behavior is by design, contacted Meta, and got no reply. Zuckerberg launched Muse last month framed as built “from the ground up for privacy and security.” The share button is where people type the account number and the revenue figure and then forget they typed it; treat every conversational share feature, on any platform, as public until you have tested the URL yourself.

Security: a KVM escape found below the hypervisor, in the stack everyone shares

The PwnEscape writeup from PWNAI Research (CVE-2026-99999) is a hypervisor escape story with the twist that the hypervisor is innocent. The team came in through Vercel’s $1 million sandbox challenge (announced August 18; Vercel’s findings report has the official accounting) and within three days of automated research found a primitive in Linux’s networking stack: guest-controlled checksum metadata can alter IPv4 header bytes after the host kernel has validated them, including the header length field. What looked like a 32-byte host-memory disclosure grew into repeatable memory disclosure and a full guest-to-host escape, in their KVM and other hypervisor environments. The upstream netdev patches went through the mailing list September 19 and 20, and netdev’s patchwork accepted them into the tree on October 8. Every agent sandbox product in the market, the ones this blog keeps covering and the ones you are probably piloting, sits on this same kernel assumption. The escape is not in your vendor’s code or even in the hypervisor; it is in the networking stack under both, so the question to ask your platform team this week is which kernel your sandboxes run, not which product.

AWS: ECS Gateway, and the first security read on Lambda Web Functions

Amazon ECS Gateway is the launch for everyone who has configured too many load balancers by hand: a fully managed ingress resource for ECS services that provisions load balancers and certificates automatically, and lets up to 25 services share a single Application Load Balancer. The consolidation is the point; the ALB spreadsheet you keep for your ECS estate just got a way to shrink.

The more useful AWS read this week is the one that revisits a launch: last week this blog covered Lambda Web Functions, the port-listening HTTP form factor, and act.security’s review (October 14, Kobi Rubin) went at its defaults. Four facts worth your time: the endpoint’s auth type defaults to none, one execution role serves every request in the environment, the pre-existing lambda:* grants already cover the new function actions, and posture scanners cannot see the resource type yet. Underneath, an execution environment serves many concurrent requests (the default cap is 64, configurable to 128), a single request can run 15 minutes, and /tmp plus global state persist across requests, on Firecracker. Aidan Steele’s launch-day notes add the detail that changes how you read the “Node only” label: packaging, not enforcement, since a one-line index.js can exec any binary in the deployment zip as long as that binary posts its own readiness signal. The recommendations are the practical version of all four facts: inventory every web-function endpoint you have, join each one to the execution role of every revision it routes to, and review those roles as internet-facing until the scanners catch up. It is the same credential-handling problem I wrote about for the AWS Builder Center when S3 landed on the Vercel Marketplace: Amazon S3 lands on the Vercel Marketplace and v0.

Accelerators: PyTorch learns Trainium and TPU

Two backends landed within days of PyTorch Conference North America (October 20). AWS’s TorchNeuron is an open-source native PyTorch backend for Trainium, written against the accelerator-agnostic extension points the PyTorch community built (the PrivateUse1 device backend and the torch.accelerator APIs), so the model code, libraries and tools you already run on PyTorch address AWS’s inference silicon as a standard device. Google and Meta followed with TorchTPU (October 20), an open-source collaboration that is a native PyTorch backend for Google’s TPUs, from an effort started at Google in mid-2025 with Meta’s PyTorch team, with eager execution optimization and torch.compile integration doing the performance work. The same framework now addresses both clouds’ in-house silicon through public extension points, which moves the lock-in argument down a layer: the training code you keep is the asset that decides how hard switching clouds is, and both chip programs just made it easier to keep it.

GCP: OpenAI and Claude land on Google Cloud

OpenAI announced on October 21 that its frontier models and Codex agentic workflows are coming to Google Cloud’s Model Garden, with Google’s own post pairing the models with Google Cloud’s access controls and data governance for the regulated-industry buyers. The same day, Anthropic made the full Claude Platform available on Google Cloud with Google Cloud authentication, billing, and commitments covering the spend. Two of Gemini’s headline competitors took storefront slots in Google’s own marketplace inside 24 hours, and the practical effect for GCP customers is procurement: model choice without a second vendor agreement, and token spend that retires against a single commitment. This quarter it reads as a partnership. Next quarter the question is resource contention inside one cloud, when a rival’s models and Gemini compete for the same capacity.

Open source: Python 3.15, TypeScript in Rust, and Agent Skills at the Linux Foundation

Python 3.15.0 shipped earlier this month (Hugo van Kemenade, the release manager, posted the full engineering diary), and release day itself went sideways: docs.python.org and the buildbot fleet went down behind a certificate failure from an incompatible pyOpenSSL upgrade, delaying the checks release depends on. The feature list worth an upgrade plan: lazy imports, built-in frozendict and sentinel types, a faster JIT, and package startup configuration files. A certificate problem stalling Python’s release day is exactly the class of failure this week’s bulletins spent four posts on, so the CA supply chain now has an open-source infrastructure anecdote to go with the enterprise ones.

Cloudflare and VoidZero introduced tsrs, a port of the TypeScript compiler to Rust, with early benchmarks of up to 8x faster and roughly 70% less memory than TypeScript 7.0 at the same type-check worker count. What makes it more than a speed claim: the team says some of those optimizations are already upstreamed from tsrs into the TypeScript line itself, which is the healthy shape of a competition, the port giving its ideas to the thing it challenges. Whether the full language semantics survive the port at 8x is what the next few releases will say.

And Anthropic donated the Agent Skills standard to the Agentic AI Foundation, the Linux Foundation home it co-founded with Block and OpenAI, where MCP already lives. The name, logo, GitHub organization, and domain move over. More than 70 agent platforms have integrated the standard since December 2025 (ChatGPT, Cursor, GitHub Copilot and VS Code among them), with a million skills published and about 280 million installed. Engineers from Anthropic, Google and OpenAI maintain the standard as individuals, and the proposed roadmap leads with versioned releases, a formal proposal process, and security guidance for skill authors, which is the part with actual weight: skills are instructions an agent will execute, and published security guidance under vendor-neutral governance beats a single vendor’s repo. This blog’s own production workflow, the agent that researches and drafts this post each week, runs as a stack of those SKILL.md files, so consider this the standard’s newest small testimonial.

Frontier AI: Claude Duet, Mercury 3, and a 3T-class Kimi

Anthropic opened a research preview of Claude Duet on October 21: a proactive agent built on Opus 5.5 that reads your connected apps, sends a morning brief, keeps working while you are away, and checks with you before it acts on your behalf. It is a standalone app on iOS and Android plus claude.ai, waitlisted for US Pro and Max subscribers first, running inside the same usage limits as the rest of Claude. The product shape lands it across from Meta’s Muse, which announced 10 million US downloads in 40 days the day before Duet’s launch, with shopping high on its engagement list. The difference worth noting through the agent-security lens this post keeps returning to: Duet’s core design promise is the check before acting, which is exactly the surface the SneakPeek discussion judged insufficient two weeks ago. A permission prompt that judges the request has one week of fresh evidence against it in the SneakPeek story above: hold both products to questions about what they can see, not what they ask.

Inception Labs released Mercury 3, claiming the first diffusion LLM that scales against autoregressive models: more than 40x larger than Mercury 1, and the company says it outperforms GPT-6 Luna and Claude Haiku 5.5 across a range of benchmarks while generating over 1,000 tokens per second (1,068 on NVIDIA GPUs), with 1M-token context and introductory pricing of $0.10 per million input and $0.35 per million output. All of those numbers are the vendor’s own until independent evaluation catches up, and diffusion LLMs’ history with real-world coding and agent work is thin. But the scaling claim, that the gains autoregressive models get from scale show up in diffusion too, is what the price of fast serving now depends on, and it is a stated bet today rather than a peer-reviewed result.

And Moonshot AI released Kimi K3.1 Pro on October 23, the first model in its K3.1 series: a post-trained successor to K3 in the 3T class, with a Highspeed variant the company says runs two to three times faster, live on the Kimi API now at $2 and $10 per million tokens, and full weights promised by November 4. The numbers on offer are Moonshot’s and unchecked: 65.7% on Terminal-Bench 4.0, ahead of GPT-6 Astra’s 58.2% and about a point behind Claude Opus 5.5’s 66.4%, plus a stress test it claims cut false statements from 23.4% to 8.3%. For the agent-security readers, Moonshot says it removed hacking-related training data from the release to limit misuse of the open weights. Three weeks ago Anthropic’s GLM-5.3 assessment made “most cyber-capable open-weight download” the industry’s question, and this is the first open-weight launch I have seen answer it by editing the training data rather than the license. Whether the removal holds up under the independent review the weights will invite in November is the part to watch.

This week on the AWS Builder Center

On the credential-handling thread above: my Builder Center piece on Amazon S3 landing on the Vercel Marketplace and v0, on the OIDC-based provisioning that replaces the static access keys. One flag under the house rules: Builder Center does not expose the article’s publish date on the page, and the piece is anchored to the October 14 S3 launch, so it may have been published in last week’s window; I am listing it flagged rather than dated.

That’s the week. If something in here was wrong, or you’ve got an opinion stronger than mine, info@stackref.com always works.

This post was created with a Hermes AI agent (hermesagent.ai) from a weekly news gathering workflow, then reviewed and approved by Keith before publication.