Daily Frontier Digest ·
LiteLLM 1.107.0 shipped credential-stealing malware through PyPI and Docker
Curated by Alfredo Borrás · Plymouth AI Lab
A poisoned LiteLLM release stole credentials for about two hours, Railway says attackers may have read decrypted customer secrets, PHP ships fixes for two unauthenticated remote-code bugs, and Anthropic previews a proactive agent app.
The story today
LiteLLM 1.107.0 shipped credential-stealing malware through PyPI and Docker
LiteLLM, the popular open-source gateway that sits between apps and dozens of model providers, says its release pipeline was compromised early on 21 October. The attacker published litellm 1.107.0 with compiled malware that steals credentials and loads remote-code-execution tools.
The bad PyPI package was live from 11:39 to 13:23 UTC. On Docker Hub and GHCR, the v1.107.0, latest, main-latest and main-stable tags pointed at compromised images from 11:46 UTC until they were pulled (by 13:51 on GHCR, 14:20 on Docker Hub). The source tag on GitHub is clean: the poisoned artifacts were built from a lookalike repository, Berri-AI/litellm instead of BerriAI/litellm. Enterprise customers on the private registry were not affected.
LiteLLM's advice is blunt: if any environment ran 1.107.0 with outbound internet, assume the theft succeeded. Do not run pip first, because the malware hides in cook.pth and sitecustomize.py, which execute on every Python start. Delete those files, kill the detached daemon holding /tmp/remote_code_loader.lock, reinstall pinned to 1.106.2 (ideally rebuild from scratch), and rotate every key the host could reach, including provider keys stored in the proxy database and the database password.
The same day, Railway disclosed that attackers may have read decrypted environment variables and said it believes this is part of a wave of attacks on platform companies aimed at AI inference providers. The common thread is that model API keys have become a high-value target.
Why it matters: Pin exact versions of anything that touches your model keys, and keep those keys scoped and easy to rotate. If you ran LiteLLM unpinned on 21 October, treat that machine as compromised and rotate now.
Sources: LiteLLM security incident report · Railway security disclosure
Highlights
PHP fixes two critical bugs that allow remote code execution without logging in
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix CVE-2026-109618 (out-of-memory handling leaves request data half-initialised) and CVE-2026-109619 (freed request state reused by a later request). Every installation serving web requests is at risk, with mod_php considered the worst case. PHP 8.1 and older get no official update, though minimal source backports exist for 7.4 to 8.1.
securitypatchSource: PHP.net news
Railway: attackers may have read customers' decrypted environment variables
Railway detected unusual activity on the systems that store environment variables and says some decrypted values may have been obtained. It tells all users to rotate every variable and registry credential, has paused deployments while it investigates, and has asked upstream AI providers to revoke keys proactively.
agent-securityplatformsSource: Railway blog
Anthropic previews Claude Duet, a proactive agent that keeps working while you're away
Built around Claude Opus 5.5, Duet sends a morning brief across your connected apps, messages you only when something needs you, takes on tasks from scheduling to dashboards and web apps, and checks before acting for you. It is a waitlist research preview for US Pro and Max subscribers, on iOS, Android and claude.ai, with a new classifier meant to block sharing card numbers and government IDs.
agentsanthropicSource: Claude
Liv Gorton reran the experiments in Nick Cammarata's 'Already Clean' essay and got different results
In a long response, Gorton raises five concerns: the neuron explanations don't survive standard experiments, the essay argues against a non-standard definition of superposition, the 'crushing' experiment has problems and didn't reproduce for her, prior work is misread, and the account isn't mechanistic. Cammarata read a draft and his clarifications are marked inline.
interpSource: Liv Gorton
GPT-2 small passes four of the five 'global workspace' tests Anthropic applied to Claude
A Second Look Fellowship team ran the functional tests from Anthropic's global workspace paper on the 124M-parameter GPT-2 small. It passed verbal report, internal reasoning, flexible generalisation and selectivity, failed directed modulation, and lacked most of the supporting structure found in Claude. The authors argue those four tests are too easy to count as strong evidence.
interpevalsSource: LessWrong
A Linux kernel module sets the RTX 3090 to its full BF16 tensor rate
gpu-unlock runs before the stock NVIDIA driver loads and writes the speed selector that picks the full BF16 rate. The author has verified it on one RTX 3090 with a specific CachyOS kernel and driver; other boards and setups are untested. Treat it as an experiment, not a supported upgrade.
localhardwareSource: Zagitta/gpu-unlock on GitHub
Concept of the day
Python startup hooks: why the LiteLLM malware ran even when you ran pip
When Python starts, it automatically processes any .pth files in site-packages and imports a module named sitecustomize if one exists. Both are legitimate ways to customise an environment, but they also mean code can run on every Python launch without anything importing it. The poisoned LiteLLM release planted cook.pth and sitecustomize.py, which is why LiteLLM warns against starting with pip install: pip is itself a Python process, so it would re-trigger the malware. Remove the files from the shell first, then reinstall.
Source: LiteLLM security incident report
Models released
| Model | Maker | Size | Notes |
|---|---|---|---|
| Flint | Recursive | 40B MoE, 2.5B active | Open-weights coding model under Apache 2.0, built for local agentic coding. Recursive reports over 125 tokens/s on an M4 Pro MacBook Pro and over 150 on a 64 GB NVIDIA RTX Spark at short contexts, and says it leads MoE models under 50B on SWE-Bench Pro v2, Terminal-Bench 2.1 and SWE-Bench Verified. Context up to 512k (256k recommended). Figures are the company's own. |
Try this
Flint Try a local coding model that keeps your code on your machine
Flint's weights are on Hugging Face and work with llama.cpp, Ollama and Unsloth. Recursive advises breaking complex work into smaller subtasks with explicit instructions, since it may need more guidance than large hosted coding models.
Source: Recursive
Every item is checked against its primary source before it appears here. Figures we could not confirm are left out.
Related service: AI automation services for logistics
Five Agent Tricks, latest: Issue #3 (26 Oct 2026) · Subscribe free