LiteLLM PyPI Backdoor | AI Field Notes #122

AnalysisSoftware behind about 70% of websites carried two remote-takeover bugs for over a decade, and AI-assisted researchers found them in roughly a week. Wiz, the cloud security firm Google bought, used its Atlas agent plus Gemini 4 Argon and GPT-5.6 Sol to find use-after-free flaws (memory reused after release, which attackers can hijack) rated up to 9.2 out of 10 and reaching back to PHP 5.4. Calif, a security testing firm in OpenAI's Patch the Planet program, found one independently with GPT-5.6 Sol. Wiz showed unauthenticated takeovers of WordPress, Drupal and Joomla. Patches shipped October 21 after a two-month wait, and the NSA told anyone who cannot patch to go offline.

AnalysisThe quickest route into an AI company's model bill now runs through its hosting provider. Railway, a platform for deploying apps without managing servers, disclosed on October 21 that an intruder reached the systems storing customer environment variables and decrypted some. Developers keep API keys, database passwords and registry credentials there. Railway paused all deployments, told customers to roll every variable, and called the attack likely part of a series aimed at platform companies to get at AI inference providers (the firms that run models for paying customers). Its follow-up checklists tell users to look for unexpected OpenAI, Anthropic, Grok and OpenRouter usage, which reads like a thief's shopping list.

AnalysisTwo hours was enough. On October 21, attackers used stolen developer credentials to override branch protections in LiteLLM's release pipeline and publish version 1.107.0 to PyPI (Python's main package registry) and Docker Hub. LiteLLM is the open-source proxy many teams put in front of OpenAI, Anthropic and Google to route model calls, so its hosts hold exactly the keys a thief wants. The payload runs at every Python startup, grabs SSH keys, cloud credentials and the provider keys stored in the proxy's database, then installs an hourly backdoor that fetches new code. The GitHub source tag stayed clean, so anyone auditing the code would have seen nothing wrong.

AnalysisAnthropic's newest app is built to talk to you less. Claude Duet, opened October 21 as a research preview for US Pro and Max subscribers on a waitlist, runs on its own virtual machine and browser, so it keeps working when your laptop is shut. It sends a morning brief, drafts replies, finds unpaid invoices, prepares payroll for review, and pings you only when a decision needs a human. It reaches more than 6,000 connectors and must ask before sending messages, making payments, signing or deleting. Anthropic warns it can misjudge urgency, and its background work eats the same usage limits as chat. Meta's Muse and OpenAI's Dots want the same slot.

AnalysisTwenty-one regressions turned up when Trail of Bits, a security research firm, went back through more than 130 of its engineers' patches that open-source maintainers had already merged. Sixteen broke normal functionality, and none broke a security protection. On October 21 the firm released two agent plugins built on that lesson. patching-bugs must prove a fix three ways: the old code fails, the new code passes, and a revert fails again. regression-hunt traces a diff to real user paths, reproduces each suspected break on a live deployment, then re-checks it with a fresh agent. In early tests it raised 25% fewer false alarms than a plain Codex prompt.

AnalysisA coding model that wakes only 2.5 billion of its 40 billion parameters per request runs on a MacBook Pro at about 131 tokens a second, roughly double comparable open models. Recursive, Richard Socher's self-improving-AI startup, released Flint on October 21 under Apache 2.0 (free to use and modify commercially), with a self-reported 74.2% on SWE-bench Verified (a test of fixing real software bugs). The stranger claim is how it was made: Recursive says its automated research system, the Eureka Machine, proposed and ran experiments at nearly every stage, letting a small team ship in under four months. Recursive also admits Flint needs big tasks broken into smaller steps.

AnalysisMost coding agents are trained inside a fixed harness, the scaffolding of tools, skills and runtime hooks around the model. A paper posted October 21 trains both together. HarnessAdapt-RL lets a teacher model write task-specific skills and propose tool changes during reinforcement learning, keeping a change only when pass rates rise. On a 9B Qwen model, the method beat standard GRPO training (a common reinforcement learning recipe) by 9.8 points on SWE-bench Verified and 12.6 on its multilingual version. Strip the evolved tools at test time, with the same weights, and scores fall by as much as 7.7 points. The limits are plain: one model, one task type, single runs.

Analysis"Capacity is the constraint," Jensen Huang said at GTC Berlin on October 21, and Nvidia put money behind the line with six packaging and testing suppliers. Substrate capacity (the layered boards GPU chips sit on) is set to grow 2.5 times over three years. SPIL, a Taiwanese chip packager, will raise output of optical engines, which move data between chips with light, 15-fold by mid-2027. Amkor plans a 300% jump in interposer wafers in South Korea by 2028, and Nvidia is advancing $1.1 billion to KYEC for US testing lines starting April 2027. Most of this lands in 2027 and 2028, so GPU scarcity has at least a year left to run.

AnalysisFederal civilian agencies must remove DeepSeek from their IT systems, along with any third-party product built on its models, under a Homeland Security order made public on October 19. The order also bars new purchases, citing DeepSeek's servers in China and Chinese laws that could expose government data. It extends a December 2025 law that covered intelligence and national security systems. China's Commerce Ministry answered with "strong dissatisfaction" and promised "all necessary measures," the vague phrasing Beijing uses before retaliating. The clause on derived products is the hard part, because DeepSeek's open weights sit inside plenty of tools that never mention the name.

AnalysisMeta now employs 66,775 people, 15% fewer than a year ago, while promising to spend at least $135 billion on capex (long-lived things like data centers and chips) in 2026, up from a $130 billion floor. Its October 21 results showed revenue up 26% to $64.6 billion and operating income down 37%, dragged by a $9.89 billion charge for a teen-safety settlement with 52 state attorneys general. To keep funding the AI buildout without diluting Mark Zuckerberg's control, the board approved a listed Class C share with no votes, handed out one-for-one from January 2027. Investors can own more of Meta's AI bet. They get no say in it.