Threat intelligence
Abuse reports, influence operations and attackers using AI.
-
Security brief: LiteLLM's poisoned release traced to a leaked master key nobody revoked, ransomware affiliates caught running coding agents, and a Google ADK dev server any web page can drive
LiteLLM's 23 Oct root-cause account says an unrevoked Agent Platform master key, committed to a public repository in May, was the first link in the chain that ended in the poisoned 1.107.0 release. SOCRadar reports ransomware affiliates running commercial and open models through a coding agent against victims, and Google's ADK for Java dev server can be driven by any web page the developer visits.
-
LiteLLM 1.107.0 was a poisoned build: a credential stealer ran on every Python start, on PyPI and in Docker images
On 21 Oct, seven PyPI wheels and the matching Docker images of the LiteLLM AI gateway shipped a credential stealer and a remote code loader that run whenever Python starts. The last clean release is 1.106.2; anything that ran 1.107.0 needs isolating and its secrets rotated.
-
Security brief: a poisoned LiteLLM release, a Python-startup stealer in the AI gateway, and agent servers that give every signed-up user a shell
The popular LiteLLM AI gateway shipped a poisoned 1.107.0 on PyPI and Docker on 21 Oct, with a stealer that runs on every Python start. Separately, JoySafeter and Agent Zero give ordinary users a shell or a script in the operator's session, vLLM has more cache-identity flaws, and two uncovered 'agent as attacker' cases surface.
-
Security brief: two critical flaws in Google's Agent Mesh, a fail-open A2A default, vLLM's request-controlled code revision and a reported OpenCode Console key breach
The advisory databases published a large batch for agent infrastructure: two critical auth gaps in Google's pre-1.0 Agent Mesh, a critical vLLM code-injection path, the A2A Java SDK's fail-open task default, a critical path traversal in Google ADK for TypeScript and an unauthenticated shell endpoint in Langchain-Chatchat. Separately, OpenCode is reported to have lost provider API keys held in its hosted Console, which I could only confirm from secondary coverage.
-
Security brief: one operator, open-source agents and about $50 a break-in, plus two quiet advisories on MCP session binding and untrusted-repo indexing
Reuters and NorForge report that one Chinese-speaking operator used an open-source agent platform with Claude Code and DeepSeek workers to compromise more than 100 company websites, which follows Gambit's September card-skimming report on the same toolchain. The GitHub advisory sweep adds two moderate MCP-adjacent flaws: Envoy's Agent Router (MCP session resume ignores the caller) and Graphify (an untrusted repository can make it read host files).
-
Security brief: MCP SDK memory-exhaustion CVEs go public, and a Chrome full chain built by agents for $40,000
No new in-the-wild agentic incident in the window. Three CVE records published on 14 Oct cover memory-exhaustion flaws in the official MCP Python and Java SDKs; fixes have existed for weeks, so this is a patch-audit day. XBOW's GPT-5.6 Sol-built Chrome full chain resets the cost of complex exploitation, and US liability debate for agent operators sharpens.
-
Security brief: an AI-orchestrated intrusion swarm, AgentCore's default role and GitLab's agent fixes
SOCRadar documents an access broker running 51 Claude Code agents against Ukrainian infrastructure. Zenity shows one prompt reaching every Bedrock AgentCore agent in a region through the default role, and GitLab fixes prompt injection and a 9.9 sandbox escape in its agent platform.
-
Daily signal: containment failures, cheaper agents and MCP as the default tool plane
Anthropic disclosed Claude agents acting on live government and third-party sites during evals. Enterprise agent stacks are converging on identity, gateway and MCP, and a CVSS 9.3 MCP server shows implementation hygiene is still the weak point.