{"slug": "ai-news-report-october-22-litellm-1-107-0-shipped-a-key-stealer-attackers-are", "title": "AI News Report, October 22: LITELLM 1.107.0 SHIPPED A KEY STEALER; ATTACKERS ARE ALREADY TESTING STOLEN KEYS", "summary": "LiteLLM published a poisoned version 1.107.0 to PyPI and Docker on October 21, and Wiz counted about 49,000 downloads of it, with attackers testing stolen AWS keys roughly four and a half hours after the 11:39–14:20 UTC exposure window. Anyone who installed the package or ran its Docker image in that window should assume cloud keys, AI API keys, SSH keys and tokens were stolen; the fix is to pin 1.106.2, delete the planted files from the shell, and rotate every key and token the machine could reach. The stealer persisted through import lines in .pth files and sitecustomize.py, which run on every interpreter start.", "body_md": "It runs on Opus 5.5 in its own cloud machine, sends a morning brief and asks before it sends, pays or signs. US Pro and Max only for now, and its background checks count against your usage.\n\nWhen a coding agent runs the CLI it gets compact tables and runaway queries stop early, which cut output by 59% in TPC-H tests. Support runs to at least October 2027.\n\nIt starts as a private preview for select enterprise customers, billed on one Google Cloud bill. The Decoder says that makes Google the only big cloud selling OpenAI, Gemini and Claude.\n\nThe model has about 1 trillion parameters with 49 billion active, trained on 3,800 Nvidia Grace Blackwell GPUs. Mistral and Nvidia will also publish benchmarks for engineering and chip-design agents.\n\nIt matched GRPO's 63.44% on MATH with about 6.5 times fewer training tokens and gained 9.9 points on AppWorld. Code is promised soon, so watch it if you fine-tune agents.\n\nIt installs with Homebrew or Go under Apache 2.0 and prints plain text unless you ask for JSON. A safe mode stops piped input from reading your local files.\n\nOn The Pragmatic Engineer, he says hiring is now the least interesting fix, since agents and tooling are better levers. He expects the leadership job as we know it to be gone within three years.\n\nThe number is just more generated text, and it shifts when you reword or re-ask. Build the score from signals you can log, like whether repeated answers agree.\n\nHe highlights Cindy Sridharan's rule that agents should collect raw facts and a working control before reading code. In one hunt the agent never set a control until asked.\n\nEnterprise security has traditionally operated on a relatively straightforward premise: establish identity, authenticate the requester, determine… · The New Stack\n\nMost people who try to run a model at home end up with a $3,000 graphics card that sits idle twenty hours a day and a chatbot that forgets the… · Codez (@0xCodez)\n\nVersions 19.5.1 down to 18.11.13 fix an integer overflow in the regex compiler that needs no login. GitLab.com is already patched, so self-managed servers are the ones to upgrade now.\n\nAmazon's honeypots caught an attempt on October 17, and it says the bug is now broadly exploited. Start your log review from October 17, not the disclosure date.\n\nRailway says some encrypted environment variables may have been decrypted, and it paused all deploys. If you host there, roll every API key and registry credential.\n\nThousands of GPT-Rosalind agents each took one gene in a mouse brain atlas, and experts preferred their reports 75% of the time. The atlas is public on GitHub.\n\nThe BriefLiteLLM, a popular open-source gateway that connects apps to AI models, published a poisoned version 1.107.0 to PyPI and Docker on October 21, and Wiz counts about 49,000 downloads of it. Anyone who installed it or ran its Docker image between 11:39 and 14:20 UTC should assume their cloud keys, AI API keys, SSH keys and tokens were stolen, and Wiz says attackers started testing stolen AWS keys about four and a half hours later. Pin 1.106.2, delete the planted files from the shell, then rotate every key and token that machine could reach.\n\nLevel UpLearn how Python runs code before your program starts. Any line in a .pth file that begins with import runs on every interpreter start, and so does a sitecustomize.py, which is exactly how the LiteLLM stealer stayed alive. Search your site-packages folders for both from the shell, not from Python, and look hard at anything you cannot explain. →Python docs: the site module, .pth files and sitecustomize", "url": "https://wpnews.pro/news/ai-news-report-october-22-litellm-1-107-0-shipped-a-key-stealer-attackers-are", "canonical_source": "https://theainewsreport.com/2026-10-22.html", "published_at": "2026-10-22 14:02:00+00:00", "updated_at": "2026-10-22 14:12:32.143658+00:00", "lang": "en", "topics": ["ai-safety", "ai-tools", "ai-infrastructure", "developer-tools"], "entities": ["LiteLLM", "Wiz", "PyPI", "Docker", "AWS"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/ai-news-report-october-22-litellm-1-107-0-shipped-a-key-stealer-attackers-are", "markdown": "https://wpnews.pro/news/ai-news-report-october-22-litellm-1-107-0-shipped-a-key-stealer-attackers-are.md", "text": "https://wpnews.pro/news/ai-news-report-october-22-litellm-1-107-0-shipped-a-key-stealer-attackers-are.txt", "jsonld": "https://wpnews.pro/news/ai-news-report-october-22-litellm-1-107-0-shipped-a-key-stealer-attackers-are.jsonld"}}