Sunday, October 25, 2026

TL;DR

If you installed LiteLLM 1.107.0, rotate credentials now - it was shipping stolen AI secrets to attackers before anyone caught it Oct 21. Patch Node.js too, fixed the same day. Jack Clark told the IMF AI has crossed into doing frontier science itself. Wiz found cloud-billing hijacks funding stolen AI usage, and Storm-0940 widening into software vendors.

Act on this

  • If you installed LiteLLM 1.107.0 (pulled from PyPI/Docker Oct 21), rotate every cloud, AI and CI/CD credential - it shipped with a credential-stealing hook. Wiz Research, LiteLLM Compromised #
  • Patch Node.js now: a Brotli-decoder flaw (CVE-2026-111497) allows remote code execution, fixed in 22.23.4, 24.22.1 and 26.12.1. Node 20 and older get no fix. Patchstack, Node.js Brotli RCE #

Signals

Anthropic's head of policy argues 2026 produced the first real evidence that AI is operating at the frontier of science, not just assisting it.  #

Jack Clark's Oct 19 Import AI, drawn from his IMF lecture, cites Anthropic researchers now producing roughly 10 times more code than in the company's first four years, Humanity's Last Exam scores rising from 8% at its January 2025 launch to 67.7%, FrontierMath from 2% to 94%, and GPT-6-Astra scoring 98% on 50 unpublished physics problems. His own framing, mostly on his own company's and rivals' data, not independent verification. Jack Clark, Import AI 477

AI-generated code volume is outpacing the tools and processes built to review it, and nobody can yet prove the spending is worth it.  #

Geoffrey Huntley's Oct 15 post argues GitHub's pull-request model is breaking under AI-written patch volume and proposes letting people remix code via Nix overlays instead of submitting PRs. Gergely Orosz's Oct 20 survey of 27 companies found weekly PRs per developer up 113% to 128% at some firms, AI spend per developer varying over 20x with no size correlation, and most companies still unable to show real throughput gains. Geoffrey Huntley, a new model for open source · Gergely Orosz, the ROI of AI spending

Practitioners are starting to automate defensive patching at the same machine speed attackers already use to automate exploitation. #

Geoffrey Huntley's Oct 21 post describes patching his entire NixOS fleet against the compromised eMudhra certificate authority in one move, using Nix's single-source-of-truth dependency graph rather than touching each system by hand. He argues defenders need more inference capacity than attackers, not just faster individual reactions, because offensive AI models will keep attacking continuously. Geoffrey Huntley, patch the planet

News

ACTWiz traces a phishing scheme hijacking cloud billing accounts to fund stolen AI usage #

Attackers bought Google ads for terms like "google cloud" to phish GCP logins, then quietly linked their own projects to victims' billing accounts to run free Gemini API usage - some bills topped $100,000 within 48 hours. Wiz, From Phishing to LLMjacking

WATCHStorm-0940's AI-pentesting campaign widens from Microsoft's customers into IT and software vendors  #

Wiz found the same actor behind Microsoft's ARTEX reports running coordinated password-spray and fake-OAuth-callback attacks against Okta, Entra and Cognito logins at IT and software vendors throughout October. Wiz, ARTEX in the Wild

WATCHWiz publishes a full anatomy of a real AI-agent-run cloud intrusion #

Wiz's incident-response team describes intrusions where an AI agent ran the whole campaign - finding entry points, harvesting credentials, and acting hundreds to thousands of times an hour across cloud, Kubernetes, CI/CD and identity systems at once. Wiz, Anatomy of a Real AI-Driven Cloud Attack

WATCHEthan Mollick: AI's measured task length has doubled eight times since GPT-4  #

Mollick's Oct 20 review finds METR's benchmark for AI task length at 50% reliability rose from about 4 minutes to roughly 17 hours since GPT-4 - a measure METR says it can no longer extend. Ethan Mollick, 30 Months on the Exponential

The long view

About a year ago, the Shai-Hulud worm spread through compromised npm packages, stealing GitHub, npm and cloud API tokens and republishing itself with them. On October 21, a malicious LiteLLM release - the AI-gateway library routing calls to OpenAI, Anthropic and other providers, with 92 million-plus downloads a month - shipped a hook built specifically to steal cloud and AI secrets, pushed through three engineers' compromised GitHub accounts. If this holds, attackers are learning the AI stack's own plumbing is worth compromising directly, not just whatever credentials a generic worm finds.

Also noted