This week's worst damage came through the plumbing around the models, and the firms holding the money had already noticed.
On October 21, Railway told its customers to roll every environment variable they had stored with it. An intruder had reached the systems holding those secrets and decrypted some of them. Railway's follow-up checklist asked users to look for unexpected OpenAI, Anthropic, Grok and OpenRouter usage. That list reads like a thief's shopping list, and the thief was shopping for model access.
The same day, someone used stolen developer credentials to publish a poisoned LiteLLM 1.107.0 to PyPI and Docker Hub. It stayed up for about two hours. LiteLLM is the proxy many teams put in front of their model providers, so the machines running it hold the provider keys. The payload went after exactly those.
Most AI risk conversations in a boardroom are still about the model: which one is smartest, whether it hallucinates, whether a cheaper one will do. This week's evidence points somewhere less glamorous. The damage arrived through a hosting platform, a routing proxy and a pile of forgotten web properties. Buyers have a dependency map they have never drawn. Sellers have a concrete audit to build around it.
The cheap end of the attack. The Cairn story set the price. The security firm NorForge reported that a single attacker has pointed open-source AI agents at more than 1,200 sites since September 25, and Reuters counted more than 100 companies breached, including web properties of Deere, SharkNinja and Cummins. A successful intrusion cost about $50 in tokens and took about 23 hours. The worker name in the logs points to Claude Code driving DeepSeek's V4.1 Flash, the model DeepSeek shipped on October 17 as a "minor update" with open weights and an 11-point gain on Terminal-Bench.
Put Cairn next to PHP2Shell and the shape gets clearer. Wiz used its Atlas agent with Gemini and GPT models to find two remote-takeover bugs in every PHP release since 5.4, in roughly a week. Patches shipped October 21, and the NSA told anyone who cannot patch to go offline. The same models are available to attackers. Finding a flaw got cheap. Fixing every exposed site did not.
Who already acts on this. The companies holding money have stopped waiting for a standard. Charles Schwab's CEO said the firm stops large AI agents, Meta's Muse among them, from moving client money tens to twenties of times a week, because of the liability once a client hands an agent a password. Jamie Dimon said outside agents will not act inside JPMorgan's systems. Yelp and Delta are blocking agents from OpenAI, Meta and Google. Schwab offers read-only access instead, so agents can look at the money and cannot move it.
1Password's October 22 launch is the commercial answer to that refusal. With 1Password for Agents, the agent proves its identity with its own key, the person approves the request on their phone, and 1Password types the credential so the model never holds it. Anthropic's Claude Duet, OpenAI's ChatGPT Work and Meta's Muse are launch partners. The same day, Axios reported that US banks see agent activity inside customer accounts and mostly cannot tell whether the customer asked for it. Duet itself must ask before it sends, pays, signs or deletes. The timing suggests vendors are building the permission layer in because the institutions holding money have already said no.
The shift underneath. The model is becoming the replaceable part. The risk and the value now sit in the layer around it: the keys, the proxies, the permissions, the monitoring, and the scaffolding of tools each model works inside.
The rest of the week keeps pointing there. Replit moved its agent's default model from Anthropic to OpenAI, citing cost, partnership and its internal benchmark, then softened the message within hours. Teams building on Replit had the model writing their code changed underneath them. OpenAI switched off gpt-4, o1, o3-mini and other legacy model IDs on October 23, six months after flagging them. Any app still calling those strings broke, and fine-tuned models built on them have to be retrained. The HarnessAdapt-RL paper showed that training a coding agent's tools along with the model lifted SWE-bench Verified by 9.8 points, and stripping those tools cost up to 7.7 points with the same weights. It covered one model and one task type, so treat it as early evidence. Anthropic's own guide told builders to fold subagents back into one loop and keep the change only if evals hold. Each of these changes the wiring around the model, and each can break a working product without anyone touching a prompt.
Where the claims need checking. Monitoring is the part of the layer vendors talk about least, and the week's best evidence says it is weaker than the pitch. Outside evaluators METR and Redwood Research found that OpenAI's agent monitor missed about 10% of eligible internal Codex traffic from May to July, because it paused whenever a model compacted its context. They also found two client headers that switched monitoring off. OpenAI responded by moving frontier training offline. If a frontier lab missed a tenth of its own agent traffic, a mid-sized company's agent logging deserves a hard look before it gets credit.
The same suspicion applies to the scores that drive model swaps. OpenAI graded GPT-6 Astra on its own new benchmark and reported COBOL pass rates rising from 10.9% to 72.1%. Recursive's Flint reports 74.2% on SWE-bench Verified and a higher Pro score that no one outside the company has reproduced. Either may hold up. Neither tells you how a model does on your refund queue or your payroll code, and the HarnessAdapt result suggests a share of any score belongs to tooling you will not have.
Who gained leverage this week is plain. Platforms that hold money, bookings and identity now set the terms for what agents may do. Attackers gained a $50 break-in. The teams that lost optionality are the ones that treated a model key as a config value, left a proxy on a floating Docker tag, or let a vendor choose their default model. Each of those choices used to be postponable. After this week they surface as an invoice, an incident report or a broken-app email.
For buyers and operators, run a key and dependency drill this week on one production AI workflow, such as support triage or a coding agent with repo access. List every place a model API key lives, including hosting platforms like Railway, proxies like LiteLLM and CI secrets. Rotate one key end to end and time it. Set a spending cap with each provider. Then grep for retired model strings and run 50 to 100 real cases through a second model, comparing cost, error rate and escalations. The decision that follows is whether you own that workflow's wiring or a vendor does, and what the contract needs to say so you can change it.
For sellers, consultants, agencies, and software teams, package a 30-day model-plumbing audit. Start with the one workflow that touches payments, customer data or production code. Deliver a map of every model call and the credential behind it, pinned versions for proxies and SDKs, a credential broker so agents never hold raw passwords, spending caps, an action log that keeps recording when an agent never hands control back, and a model-swap test on a fixed set of real cases. Railway, LiteLLM, Cairn and Schwab's refusals give every client a reason to want it this quarter.
The old assumption is that AI risk lives in picking the right model. This week the model changed underneath Replit's users, retired under OpenAI's oldest integrations, and helped one attacker into more than 100 companies at about $50 a break-in, while the losses ran through keys and pipes. A better operating rule is to treat every model as replaceable and every credential and permission around it as the asset you defend. Put the next planning hour into who holds the keys to your model bill and who can change your default model, since attackers and banks have both already asked.
The week in one line: Treat the model as the replaceable part and defend the keys, proxies and permissions around it, because that is where this week's breaches and refusals landed.
Sources this week: Railway breach, LiteLLM backdoor, Cairn agent campaign, PHP2Shell, Schwab and JPMorgan block agents, 1Password for Agents, Replit switches to OpenAI, OpenAI legacy model shutdown, HarnessAdapt-RL, OpenAI agent monitor gaps, MultiLangBench, Recursive Flint