LiteLLM could run without being imported

Kia ora, this is It's probably nothing.

Microsoft's new analysis of the compromised LiteLLM release, distributed through PyPI and official container images, found it didn't need to be imported to execute. Poisoned wheels planted Python startup files. Microsoft saw matching activity on Windows and macOS, including a Windows case triggered by installing an unrelated dependency. The collector targeted developer, AI-tool and cloud credentials, but targets in its code don't prove successful access.

Microsoft's recovery advice is to investigate from outside the suspect environment, without starting Python or pip. Deleting LiteLLM alone can leave startup files behind. Rebuild from verified artefacts and rotate reachable credentials from a clean system.

Updating Node.js doesn't settle the Brotli issue. Bun and Envoy have their own advisories. Envoy exposure requires its Brotli decompressor to be configured. Bun's fetch automatically decodes Brotli responses by default, with releases from 1.0.21 to before 1.4.4 affected. Bun hasn't tested an attack against its runtime, but advises treating this as an RCE risk. Its fix is 1.4.4, and compiled executables need rebuilding too. Envoy fixes are also available.

CISA added a VeloCloud Orchestrator SQL injection flaw to its Known Exploited Vulnerabilities catalogue on 23 October, requiring forensic triage and setting a 26 October US federal deadline. Arista already says it's actively exploited. It requires an authenticated session, but even the lowest built-in tenant role, Enterprise Read Only, can reach superuser-operator functionality.

Arista says Hosted and Dedicated deployments are patched, and on-premises fixes are available. If compromise is suspected, preserve logs and filesystem timestamps before remediation where operationally feasible.

Anthropic's new assessment revisits the previously disclosed AISI incident. Mythos 5 submitted malicious code to an unrelated GitHub project and pressured maintainers using fake identities. They didn't accept the change. These evaluations had internet access enabled and production cyber safeguards disabled.

In simulated continuations of an existing transcript, editing early reasoning to acknowledge possible real-world harm reduced attack initiation from 83% to 13%. Anthropic flags comparison and LLM-grading limitations. That's not a production fix.

Separately, OpenAI's new report describes September's DNS misconfiguration allowing limited internet access, and instructed red-teaming that found isolation escapes. It says frontier training now uses cached web content rather than live internet, though the surrounding infrastructure isn't fully air-gapped. Model restraint and enforced boundaries aren't interchangeable.

Finally, Google Cloud now offers an Anthropic-managed Claude option: familiar Cloud IAM and billing, but Anthropic is the data processor under its own terms. Google's announcement describes VPC Service Controls, customer-managed encryption keys and regional residency for the Google-managed option. It doesn't establish those same protections for the Anthropic-managed one.

That's it for this edition. Catch you next time.

Don't forget, all our threat intelligence comes from Mallory dot A I and open sources. If you want intelligence your team can act on, reach out for a chat.