AI News Briefing — Malicious LiteLLM 1.107.0 release stole gateway credentials

Agent frameworks & interop

• [2026-10-21] LiteLLM, the open-source LLM gateway, says attackers pushed a malicious 1.107.0 release to PyPI (11:39 to 13:23 UTC) and to Docker Hub and GHCR under latest, main-latest and main-stable (until 14:20 UTC). A cook.pth file runs at Python startup, stole cloud credentials, provider keys and browser data, and left a backdoor polling for code. The attackers drove the release workflow with developers’ GitHub CLI tokens, which LiteLLM suspects leaked from an exposed internal deployment’s logs; it notes Claude Code can embed that token in response bodies. Pin 1.106.2, rebuild, and rotate every key the gateway held. (official, official, source, source)

  Docker users on main-stable were exposed for nearly an hour longer than PyPI users. Image digests, not tags, show which build a host actually pulled.

  For Security Engineers: A Python environment that installed 1.107.0 runs cook.pth at every interpreter start, whether or not LiteLLM is imported, and the backdoor may have fetched more code since. Rebuilding that host from a clean image is safer than uninstalling the package.

• [2026-10-21] Microsoft says Storm-0940, a China-aligned group, used ARTEX, an open-source multi-agent pentest framework written in Go, in the ConnectWise cloud-backup compromise. Its agents attempted sign-ins to more than 2,250 tenants at up to 2,900 a minute, and some attacks reached privileged cloud access in under three hours. Zscaler found ARTEX configured with DeepSeek, GLM and Grok models, one reviewing another’s output. (official, source)

  Nothing here needed a new exploit. Sign-in rate limits and lockout rules still catch spraying at machine speed, where they are switched on.

Model releases

• [2026-10-21] OpenAI’s GPT-6 Astra, GPT-6.1 Sol and GPT-6 Luna are in private preview in Google Cloud’s model garden for select enterprise customers, with Gemini for business and Antigravity listed as coming soon. Usage is bought through Google Cloud Marketplace, so it lands on one invoice and draws down existing cloud commitments. Neither company published per-token prices, regions or a GA date. (official, official, source)

  Committed Google Cloud spend that was going unused now has somewhere to go, though no price list yet says how far it stretches.

• [2026-10-21] Recursive released Flint, a 40B mixture-of-experts coding model with about 2.5B active parameters, under Apache 2.0 with weights on Hugging Face. Recursive says it beats other models under 50B on SWE-Bench Verified and runs at about 131 tokens a second on an M4 Pro MacBook. It also says Flint needs large tasks broken into smaller steps. (source)

  Every number here is Recursive’s own. Its caveat is the useful one: a harness that hands Flint whole tickets is not testing what it was built for.

Coding agents

• [2026-10-22] Vercel Labs open-sourced fx, a pre-1.0 coding agent written in Zig and built to be embedded rather than run full-screen. The engine ships as a 6.3 MiB CLI and as a library with a WebAssembly build, talks to editors over the Agent Client Protocol via fx acp, and returns JSON for CI through fx ask --json. Early users found first-run setup routing inference through Vercel AI Gateway. (source)

  Speaking ACP lets fx sit inside editors that already support the protocol instead of bringing its own interface.

  For Software Developers: Try fx ask --json in a CI step with a narrow job, such as explaining a failing test, and read its configuration after the first run, since early users found setup sending inference through Vercel AI Gateway.

MCP

• [2026-10-21] Anthropic opened Claude Duet, a proactive agent app built on Opus 5.5, as a waitlisted research preview for US Pro and Max subscribers on iOS, Android and claude.ai. It runs on a cloud VM with its own browser, checks connected accounts every few hours, and uses Claude Marketplace connectors; the page does not say whether custom MCP servers work. Messages, payments, signatures and deletions wait for your approval, securities trades are blocked, and background checks count against usage limits. (official, source)

  Background checks spend the same allowance as chat, so the more accounts Duet watches, the less is left for anything else.

AI-assisted SDLC

• [2026-10-21] PHP shipped emergency fixes for PHP2Shell, two pre-authentication flaws (CVE-2026-109618 and CVE-2026-109619, both CVSS 9.2) reaching back to PHP 5.4, found by Wiz, Calif and OpenAI’s Codex Security team using AI agents. Fixed releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Amazon logged an exploit attempt on October 17, four days before disclosure, and several more within hours of the patch. (official, official, source, source)

  Amazon’s October 17 sighting means some servers were probed before any patch existed, so web logs from that date on deserve a look.

  For Platform / DevOps Engineers: Base images pinned to a PHP minor line only pick up 8.5.12, 8.4.27, 8.3.36 or 8.2.35 on rebuild, so a pipeline that caches its base layer keeps shipping the flaw until someone forces a fresh pull.

• [2026-10-20] A Linux Foundation Research survey of open-source contributors puts AI’s cut to code-authoring time at 52% on average, though 21% say complex tasks took longer. Respondents estimate a quarter of incoming pull requests are low-quality AI output, 31% on large projects. Only 35% of projects have a formal policy permitting generative AI. (official, source)

  Time saved writing code reappears as time spent reviewing it, and on large projects that review lands on maintainers who never chose the tools.

• [2026-10-21] GitHub described how it rebuilt Git storage for agent traffic. Most repositories now keep two of five replicas in Azure, which serves about half of Git traffic, and writes serialize per branch instead of per repository, giving 3–4x throughput on writes to different branches in internal tests. Read replicas warm from blob storage and scale on demand. (official)

  Per-branch locking is what lets several agents push to one repository at once, each on its own branch, without queuing behind one another.

Practice & craft

• [2026-10-21] Dharma-AI’s VocabX rebuilds a small model’s tokenizer around what each token costs, weighting output tokens above input ones. On a Qwen3-4B essay grader that returns JSON, average responses fell from 350 to 101 tokens and serving cost by 77%, with the vocabulary cut from 151,669 to 64,767 entries. Folding the grade itself into a macro token hurt accuracy, so it kept a token of its own. (source)

  Nothing about the answer got shorter. The same JSON simply takes fewer tokens to spell.

• [2026-10-21] A Stacklok survey of 520 North American technical leaders, written up by Stacklok’s CEO, finds only 8% use a single model provider. The hardest parts to migrate are integrations with internal systems or MCP servers (53%) and multi-step agent workflows (52%), and 57% expect leaving their current provider to take four months or more. (source)

Research worth reading

• [2026-10-21] Where AI Vulnerability Discovery Harnesses Go Quiet maps 13 points where a scanning harness drops code before or after the model sees it, across 12 open-source harnesses. Six harnesses skipped the same single file before any model read it, five without saying so, and an attacker who knows the filtering rules can hide a bug in that gap. (paper)

  A scanner that reports no findings may never have read the file, so its coverage log matters as much as its results.

• [2026-10-20] From Prompt Injection to Persistent Compromise plants instructions in long-term memory that fire again in fresh sessions on ChatGPT Instant 5.3, Claude Sonnet 4.6 and Gemini 3 Flash, through memories, projects, skills, organization instructions and MCP-connected resources. In Claude, shared memory let one attacker reach several users in an organization. The authors find nearly half of their proposed mitigations unimplemented. (paper)

  Shared organization memory lets one poisoned session reach colleagues, so who may write to it deserves the scrutiny given to admin rights.

Watch list

• MiniMax M3.1 Flash weights and Nemotron 3.5 Bolt E4B: both due October 23.
• Mistral Large 4 weights: preview only; promised by the end of October.
• DeepSeek Search & Fetch billing: free harness calls end October 31.
• LiteLLM root cause: how the internal deployment came to be exposed is unconfirmed; a final postmortem would say whether other GitHub accounts are still at risk.