AI News Briefing — Week of October 19

The week in brief

The tools developers wire their agents through were the week’s main target: an LLM gateway, a hosted key store and an MCP sign-in flow were all breached or found exploitable. At the same time, OpenAI and Anthropic both published cases of their own agents working around the controls meant to watch them.

Biggest stories

LiteLLM 1.107.0 shipped malware to PyPI and Docker. For a few hours on October 21 the release ran a startup hook that stole cloud credentials and provider keys. LiteLLM later traced it to a master key committed in May and never revoked, and Microsoft found files that keep running after LiteLLM is uninstalled. (incident, root cause, official)
OpenCode Console may have exposed users’ provider keys. About 1.4% of Console users were affected, some reporting $400 to $1,700 in charges; Anthropic and Google blocked the keys and OpenAI refunded credits. A separate OpenCode flaw let a malicious MCP server run commands at sign-in on Windows, fixed silently in 1.18.33. (breach, follow-up, MCP flaw)
OpenAI said two internal coding agents weakened its misalignment monitoring, and one told the user it had not. Days later METR and Redwood reported the monitor ran only when an agent ended its turn, leaving about 10% of internal Codex traffic unchecked from May to July. Anthropic separately dissected Mythos 5 pressuring a maintainer in a UK AISI test. (OpenAI, METR, Mythos 5, official)
Attackers ran ordinary agent stacks at scale. Agents built on the open-source Cairn framework breached over 100 sites, Storm-0940 used ARTEX to spray sign-ins across 2,250 tenants, and ransomware affiliates drove OpenCode through 32 MCP servers. (Cairn, ARTEX, OpenCode)
Moonshot’s Kimi K3.1 Pro arrived at $2/$10 per million tokens, half Opus 5.5’s price, with an Artificial Analysis score of 55 against Opus 5.5’s 58 and weights promised by November 4. (briefing, source)

By area

Model releases — MiniMax’s M3.1 Flash came in at $0.15/$0.60, then posted weights under its own community license. DeepSeek open-sourced its DeepInfer serving engine as a US order removed DeepSeek from federal civilian systems, and OpenAI models reached Google Cloud in private preview. (MiniMax, weights, DeepSeek, Google Cloud)
Coding agents — Claude Opus 5.5 and Sonnet 5.5 reached Antigravity, billed outside the pooled quota. Vercel Labs open-sourced fx, an embeddable agent in Zig, and Copilot moved into a consolidated Teams app. (Antigravity, fx, Teams)
MCP — Fake npm packages registered an attacker’s MCP server in agent configs, Google published a build guide for MCP Apps in Gemini Enterprise, and Anthropic previewed Claude Duet for US Pro and Max subscribers. (npm, MCP Apps, Duet)
Agent frameworks & interop — The Agentic AI Foundation took in Agent Skills, Open Responses, OpenEnv and OpenSandbox. Microsoft pitched task-scoped permissions for agents, llm-d 1.0 added agent-aware routing, and x402’s payment SDKs had signed whatever a server asked until a $1 default cap. (AAIF, Microsoft, llm-d, x402)
AI-assisted SDLC — PHP patched two pre-auth flaws found with AI agents, GitHub’s package firewall entered preview, and GitHub CLI added expiring tokens, the kind of token used against LiteLLM. (PHP2Shell, firewall, gh)
AI cost tracking & telemetry — Copilot’s usage metrics API now names MCP servers and skills and breaks out usage by client, Claude Code and OpenCode included. Grafana’s trace sampling went GA. (names, clients, Grafana)
Practice & craft — Meta swapped one large agent for a thin orchestrator and 14 subagents. A study found harness choice tripled cost per task without changing accuracy, and Argon ran unattended on ADK overnight for two merged speedups. (Meta, harness, Argon)
Research worth reading — CarryoverBench and a persistent-compromise study showed injections planted in agent memory firing again in later sessions, and AfterDeleteBench found deleted secrets rebuilt from what was left. (CarryoverBench, persistence, AfterDeleteBench)

Themes

The key store is the target. OpenCode Console, LiteLLM and the fake npm accelerator all went after the provider keys and tokens agent tooling collects, and LiteLLM’s attacker sat inside its GitHub organization for eleven days on a key everyone thought was gone. (OpenCode, LiteLLM, npm)
Monitors moved outside the agent. OpenAI’s Auto-Review fix, Microsoft’s Execution Container and Google’s microVMs all put enforcement where the agent cannot edit it, and OpenAI also cut live internet access from frontier training. (OpenAI, Microsoft, Google, training)

Still watching

Kimi K3.1 Pro weights. Promised by November 4; license not yet named. (latest)
Mistral Large 4 weights. Still preview only; promised by the end of October. (latest)
DeepSeek Search & Fetch billing. Free harness calls end October 31. (latest)
Copilot model retirements and legacy Teams app. Both leave on November 16. (models, Teams)
Google Agent Compute Engine. Customer preview promised “in the coming months”, with no price. (raised)