This week at a glance
The week’s theme is the credentials your pipeline already holds. LiteLLM’s postmortem traces its poisoned release to a master key committed to a public repository on May 27. The commit was removed, but the key was never revoked. On October 10 an attacker used it to get into LiteLLM’s internal agent platform, took a CLI OAuth token with owner-level access to every repository, and went on to steal CI secrets and two maintainers’ tokens. Release 1.107.0 sat on PyPI for under two hours and was downloaded about 49,000 times. Separately, Radware found 83 malicious issues, pull requests and comments across 61 public repositories, most posted in one 43-minute burst, each hiding shell commands in HTML comments that vulnerable workflows ran within a second. Neither attack needed a bug in the code. Both needed a token or a workflow with more reach than it should have had.
The second thread is AI-found bugs reaching the people who fix them. Drupal published 256 security advisories from June to October, more than in the previous 30 months combined, and says a funded review team plus AI triage is the only reason its volunteer process did not buckle. OpenAI reports 458 of 661 Patch the Planet fixes accepted by maintainers, and its cyber executive in residence asked researchers to send reports a single person can read. The OpenSSF published a free guide to finding and fixing vulnerabilities with AI. A Linux Foundation survey finds three in four maintainers now use AI to vet incoming changes, while one in five contributors never discloses AI use.
The third thread is agents inside the toolchain, and what they cost. Anthropic’s Claude Code team gates merges by risk tier, and an agent’s approval never counts as a person’s. Google open-sourced a plugin that makes an agent defend its design to fresh-context reviewers before writing code, and opened Android Studio to more than 40 third-party agents. About a third of MCP’s conformance scenarios now test security. On cost, Aiven says moving heavy users to open-weight models cut their spend by about 80%, LeadDev warns that per-seat plans are subsidised roughly tenfold, and an Amazon memo tells engineers that work AI does not help with “is a finding, not a failing.” ENISA’s SBOM advisory and a new set of supply-chain awards show what good evidence and practice look like.
On our watch list
- Fallout from LiteLLM’s token sweep. LiteLLM is revoking every token on every internal system and vendor platform, and says the attacker went after upstream inference API keys. Watch for reports of abuse of stolen LLM-provider keys, and for a fuller account of what the attacker changed in internal repositories.
- Whether the 61-repository campaign led to anything worse. Radware found log evidence that the hidden command ran in two cases but cannot say whether any write access was gained or release poisoned. Not every affected project has confirmed a fix. Watch for downstream advisories from the named projects.
- Drupal’s standard for AI-assisted security reports. Phase 2 of the initiative drafts a standard for useful AI-assisted reports, and core maintainers have proposed release-process changes after a peak of 39 advisories in one day. Watch whether other foundations in the same funding cohort publish comparable numbers.
- Patch the Planet acceptance rate. OpenAI says maintainers accepted 458 of 661 developed patches, about 69%. Watch whether that ratio holds as volume grows, and whether OpenAI publishes rejection reasons.
- MCP authorization moving from draft to spec. Proof-of-possession tokens and workload identity federation are on the MCP auth roadmap as drafts, and about a third of 116 conformance scenarios now test security. Watch for these landing in the specification and in major client SDKs.
- Circuit breakers for zero-human merges. Anthropic’s Claude Code team says it lacks automatic controls that tighten approval when revert or incident metrics move, and engineers want them before more code moves to zero-human merges. Watch whether it publishes how they work.
- Permission models for third-party agents in Android Studio. More than 40 agents can now use the emulator, Logcat and project structure through the Agent Client Protocol. Watch for Google documenting what those agents can reach and how enterprises can restrict them.
- A “good enough” SBOM profile. ENISA’s survey respondents asked for a profile defining a practical minimum SBOM and a risk framework that uses SBOM data. Watch for follow-up ENISA guidance ahead of the Cyber Resilience Act’s full application in December 2027.
- The end of per-seat AI subsidies. Anthropic’s Enterprise plan and OpenAI’s Codex on ChatGPT Enterprise have already moved toward metered pricing. Watch Q4 renewal terms for the remaining seat plans, and how teams budget for a roughly tenfold difference.
- Aiven’s gateway as a service. Aiven plans to offer the LiteLLM-based gateway it uses internally to customers. Watch whether it reports cost-per-task results, not just token savings.
- How the Amazon memo plays out in reviews. The memo says token counts are “deeply flawed” but still asks managers to examine adoption data. Watch for performance-cycle policies at large employers that say explicitly how documented AI non-use is treated.
This week’s topic map: CI/CD tokens and secrets anchor the pipeline cluster, linked to LiteLLM’s unrevoked master key and poisoned release, and to the hidden-command campaign against GitHub workflows. AI-found vulnerability reports tie Drupal, Alpha-Omega, OpenAI and the OpenSSF guide to contribution policy at the Linux Foundation and LibreOffice. Anthropic and MCP anchor the agent cluster (risk-tiered review, Google’s Elephant-Goldfish plugin, Android Studio agents), which links through Aiven’s LiteLLM-based gateway to token costs and token-as-metric debates. ENISA, the CRA and signed SBOMs sit with the supply-chain awards.
View interactive topic map →
Article index
Pipeline and package attacks
Two attacks that needed no code vulnerability: a master key that was deleted but never revoked, and shell commands hidden in issue comments that vulnerable workflows ran within a second. Plus a reminder that a package can pass install-time checks and still run hostile code later.
AI-found bugs, maintainers and contribution policy
AI now finds real bugs at volume. Drupal shows what absorbing them took, OpenAI asks reporters to write for one human reader, the OpenSSF publishes a playbook for fixing what AI finds, and projects work out who may use AI and how they must say so.
Supply-chain evidence and practice
ENISA describes a signed, automated SBOM lifecycle with a threat model of its own, and an industry awards programme names the organisations stopping threats at the point of entry and extending governance to AI models, skills and MCP servers.
Agents in the toolchain: protocols, review and quality
Agents now arrive through IDE marketplaces and CLIs, talk to tools over MCP, and write most of some codebases. The question this week is what gates their output: risk tiers, fresh-context reviewers, and checks built into the harness.
Token economics and how engineering is measured
Per-seat AI plans look subsidised, heavy users are being routed to open-weight models, and companies are learning that token consumption is a poor proxy for output.
Running LLM applications in production
Uptime and answer quality are different signals, and a provider can change a model under a working application. Two practical guides on tracing sessions and surviving model updates.
Detailed write-ups
1. A deleted key that was never revoked: inside the LiteLLM postmortem
The Register · October 26, 2026 · InfoWorld · October 26, 2026
LiteLLM has traced last week’s supply-chain compromise to a configuration file containing a master key, committed to a public repository on May 27. The key belonged to an open-source tool LiteLLM used internally to orchestrate AI agents. Developers spotted the mistake and removed the commit, but did not revoke the key. On October 10 the attacker used it to get into the LiteLLM Agent Platform and extract a CLI OAuth token. “From this point onwards, the threat actor had owner-level access to all repositories in our GitHub,” the postmortem says. Those CLI tokens are issued after two-factor authentication and do not trigger the platform’s re-authentication step for high-impact actions.
From there the attacker committed malicious workflows to internal repositories to collect CI secrets, took the CLI tokens of two engineers with maintainer rights, and gathered tokens for other internal systems, focusing on upstream inference API keys. Because every action appeared to come from credentialed engineers, nothing looked unusual. The poisoned release, 1.107.0, reached PyPI and LiteLLM’s container registries. It was on PyPI for less than two hours but was downloaded about 49,000 times, according to figures cited by The Register. It carried an infostealer and a remote access trojan aimed at browser credentials, AWS, Google Cloud and Azure credentials, and LLM-provider API keys. Anyone who ran it should assume every credential on that host is stolen. LiteLLM is now revoking every token on every internal system and vendor platform. “This incident has provided a strong illustration of the risks associated with failing to rotate a potentially exposed key,” it wrote.
The chain matters more than the first mistake. An agent platform held a token that could rewrite every repository, and CI jobs exposed secrets to any workflow that could be edited. An InfoWorld feature makes a related point about consumers. Install-time controls such as blocking scripts are useful but incomplete, because a package’s code also runs at module load and at every function call, with the application’s own permissions. One malicious lookalike package had no install hook at all and hid its loader in an ordinary method, triggered by a specific key. “An install-time policy can tell us whether a package executed during installation. It cannot tell us whether code inside that package is safe to execute later.” The recommended controls are a dependency diff on every pull request, a named owner for new packages and publisher changes, disposable test environments with no production secrets, and release tokens kept out of jobs that do not publish.
Sources: https://www.theregister.com/security/2026/10/26/litellm-supply-chain-attack-started-with-an-exposed-master-key/5305544, https://www.infoworld.com/article/4236783/your-npm-install-was-safe-what-happens-when-the-package-runs.html
2. Hidden commands in issues hit 61 repositories in 43 minutes
The Register · October 29, 2026
Radware researchers found at least 83 malicious issues, pull requests and comments across 61 public GitHub repositories, in what they assess as a coordinated attempt to run commands in CI environments and steal credentials. 77 were posted within 43 minutes on September 1, and the remaining six within the next two minutes. The attacker used 74 accounts, many with real development histories and probably compromised. Researchers Gabi Nakibly and Zvika Babo suspect one person was behind it.
The technique is simple. The attacker puts shell commands inside an HTML comment, so nothing shows on the rendered page. Opening an issue or pull request triggers any workflow configured to respond to that event, usually within a second. If the workflow inserts the event’s text directly into a shell step, the hidden command runs, collects environment variables and sends them to an attacker’s server. “Basically, every user with a GitHub account can try to run this attack – it’s very easy to start this attack,” Babo said. Targets included Google’s LangExtract, MLflow, the Brave browser, discord.js, Cilium, .NET MAUI, Homebrew Cask and PX4 Autopilot.
The researchers found log evidence that the command ran in two cases. They cannot say whether the attacker obtained write access or changed any released code. Most projects fixed their workflows after disclosure, but not all have confirmed. The advice is to treat every issue, comment and pull request body as untrusted input, never interpolate it into shell, separate workflows triggered by outside events from jobs that hold elevated permissions, and limit the secrets and environment variables any workflow can see. “The only way is to make sure that the workflow code is resilient, and not vulnerable to such attacks,” Nakibly said.
Sources: https://www.theregister.com/security/2026/10/29/attackers-turn-github-issues-into-supply-chain-campaign-against-61-public-repos-in-less-than-an-hour/5306153
3. Drupal’s 256 advisories show what absorbing AI-found bugs takes
Drupal Association · October 29, 2026 · CyberScoop · October 27, 2026 · OpenSSF · October 20, 2026 · InfoWorld · October 27, 2026
Drupal published 256 security advisories from June to October 2026, more than the 250 it published in the previous 30 months combined. Monthly volume went from an average of 8 early in the year to 28 in June, 74 in September and 106 in October, with a record 39 on October 28. 134 people have been credited as reporters since June 1, against 68 in all of 2025. Alpha-Omega funded a Security Engineer in Residence grant in May, which paid for a fixer and reviewers, and provided access to Anthropic’s AI tooling. The funded team took part in 87% of the advisories.
The tooling is unglamorous. A triage bot posts a suggested classification and likely duplicates for each new report, and has flagged about 20% of reports as probable duplicates since mid-August. AI proposes weakness classifications for CVE records, and a human verifies every one. The team also found that an open-source static-analysis tool had been silently skipping valid PHP 8 code in about 350 files across 176 projects, and got it fixed upstream. Six hardening changes landed in core, three of them neutralising known PHP object-injection gadget chains. “Funding the complete review workflow is the only reason our volunteer process kept publishing without buckling,” the programme coordinator writes. Next comes a draft standard for useful AI-assisted reports.
OpenAI is pushing in the same direction. Speaking in Washington, its cyber executive in residence Michael Aiello said maintainers will not respond to “hundreds and hundreds of AI-submitted vulnerabilities” and some have stopped taking submissions. His advice to researchers: “Make sure they’re really high quality, make sure it’s consumable and readable by a single person,” and spend your own resources on coordinating disclosure. OpenAI’s Patch the Planet reports 661 patches developed and tested, and 458 accepted. The OpenSSF’s new free guide from David A. Wheeler turns this into a process: separate the agent that finds a bug from the one that validates it, run several approaches, never merge an AI patch without automated tests and human review, and turn each fix into a regression test or static-analysis rule. As Wheeler puts it, “Finding vulnerabilities doesn’t help unless they’re fixed.” In an InfoWorld opinion piece, Matt Asay argues that this is where open source gains value: a shared codebase lets everyone carry a fix forward instead of rediscovering it.
Sources: https://www.drupal.org/blog/256-advisories-in-five-months-results-from-the-drupal-ai-security-initiative, https://cyberscoop.com/openai-ai-generated-bug-reports/, https://openssf.org/blog/2026/10/20/new-openssf-guide-finding-and-fixing-vulnerabilities-using-ai/, https://www.infoworld.com/article/4239955/robot-eyeballs-make-open-source-more-valuable.html
4. AI contributions: maintainers vet with AI, projects ask for disclosure
Help Net Security · October 26, 2026 · The Register · October 29, 2026
A Linux Foundation survey of 234 contributors and maintainers, reported by Help Net Security, puts numbers on how projects are adapting. Maintainers of projects with more than 50 contributors estimate that close to one-third of incoming changes are low quality or AI-generated, against about one in four across all projects. About a third of projects formally allow AI-assisted contributions and one in ten bans them, while about a quarter of maintainers have no check for AI-assisted code at all. Three in four maintainers now use AI tools to vet incoming changes. Six in ten contributors say they fully test AI-generated code before submitting, but about one in five never discloses AI involvement. Large projects rank burnout as their top concern; smaller ones rank code quality first. The report notes that curl’s Daniel Stenberg now sees “an ever-increasing amount of really good security reports, almost all done with the help of AI.”
LibreOffice shows how this plays out under a strict public stance. The Document Foundation markets the suite as free of built-in AI and says its core developers do not use LLMs. Three commits this year nonetheless acknowledge LLM assistance from community contributors. The foundation’s policy does not ban specific tools but requires disclosure, discourages LLM use and prohibits it for students. “We carefully review submissions by contributors to make sure the code quality is good and that the patch author understands their own code,” it said. For consumers of open source, a published contribution policy and a disclosure requirement are now reasonable things to check when assessing a dependency’s maintenance health.
Sources: https://www.helpnetsecurity.com/2026/10/26/linux-foundation-open-source-ai-slop/?ref=feedbagel.com, https://www.theregister.com/ai-and-ml/2026/10/29/libreoffices-no-ai-stance-meets-llm-assisted-code/5306084
5. MCP turns to security as the agent foundation grows
InfoQ · October 26, 2026
At AGNTCon + MCPCon in San Jose, the Agentic AI Foundation reported ten hosted projects after a year, up from three, and added three governance committees. “A year ago, AAIF launched with three projects and a bet that agentic AI needed a neutral home to thrive. Today we host 10,” said CTO Manik Surtani. For security teams, the Model Context Protocol news matters more. About a third of the protocol’s 116 conformance scenarios now test security. Enterprise-managed authorization is live in Claude, and the auth roadmap lists proof-of-possession tokens and workload identity federation as drafts.
Usage is growing fast. Cumulative SDK downloads reached 4.17 billion, a July specification change added stateless servers that some platforms say carry about 70% of their traffic, and MCP tasks in Claude Code let tool calls run for minutes, hours or days. Long-running tool calls with real credentials are exactly where bound tokens and workload identity help. The same event showed why. On the ExploitGym benchmark, one frontier model produced about 230 working exploits against 869 targets in two hours, and more than 80 with standard mitigations enabled. Inventory the MCP servers your developers and agents use, prefer centrally managed authorization over personal tokens, and plan for proof-of-possession once it ships.
Sources: https://www.infoq.com/news/2026/10/agntcon-mcpcon-2026/
6. ENISA’s SBOM lifecycle, and the supply-chain practices being recognised
Industrial Cyber · October 26, 2026 · JFrog · October 27, 2026
ENISA’s Technical Advisory for Software Bill of Materials treats SBOMs as a foundation for security, not a complete solution, and their value depends on feeding vulnerability handling and patching. The advisory recommends SPDX or CycloneDX, validating inventories against the actual artefacts, verifying signatures and generating SBOMs inside CI/CD. Its lifecycle runs from build to generation, validation, cryptographic signing and storage next to the artefact, with automatic regeneration when components change. The minimum viable implementation is build-time generation, when dependencies are most accurately known. An event-triggered pattern adds webhooks on commits, pull requests and releases and keeps a generation history for audit.
The advisory includes a STRIDE threat model for SBOMs themselves. Tampering with components, hashes, provenance or package identifiers leads to missed vulnerabilities. Mitigations include signatures, identity checks, build attestations and strong key management, and uncontrolled sharing can give attackers a map of exact versions to target. SBOM processes should also produce audit evidence: logs, validation results, signatures, timestamps and retention records. That matters as the EU Cyber Resilience Act becomes fully applicable in December 2027.
JFrog’s first Software Supply Chain Excellence Awards, presented at swampUP in New York and Barcelona, describe the same practices from the operator side. Nine organisations were recognised in three categories, judged on strength of vision and quality of metrics. Ford Motor Company, Rakuten Symphony and SCHOTTEL Industries standardised on a single system of record for building, securing and shipping software. S&P Global, Iress and TSB Bank stop threats at the point of entry, not after release. NVIDIA, Singapore Airlines and Husqvarna Group extended governance to AI models, agent skills and MCP servers. “Increasing regulations require proof at every step – from code to runtime,” said JFrog’s Roie Shorer.
Sources: https://industrialcyber.co/sbom/enisa-links-sbom-automation-integrity-safeguards-and-lifecycle-management-to-software-supply-chain-security/, https://jfrog.com/press-room/jfrog-and-industry-judges-recognize-global-brands-bringing-trust-to-the-software-supply-chain/
7. Risk-tiered merges and design-first agents
InfoQ · October 29, 2026 · Help Net Security · October 26, 2026 · The Decoder · October 28, 2026 · O'Reilly Radar · October 15, 2026
Anthropic says Claude writes about 90% of Claude Code’s own code, and its monorepo went from about 2,500 merged changes a day in May to more than 30,000 in September. The target is for most pull requests to merge with at most one human in the loop and no rise in reverts or incidents. A classifier assigns each change a risk tier. Low-risk changes such as docs, copy and additive changes behind a flag need no human approval, and medium-risk changes such as caching, the auto-updater or system prompts need one person. An agent’s approval never counts as a person’s, and whoever prompted the change is a required reviewer. One pull request went through more than 50 review rounds overnight before the team capped them. “Nobody on the team keeps a complete mental model of Claude Code in their head, and we don’t think anyone needs to,” the team wrote. Practitioners pushed back; one asked who debugs the system when no one has a causal model of it. The team admits it still lacks circuit breakers that tighten approval when metrics move, and its open-source security-review action warns that it is not hardened against prompt injection and should only review trusted pull requests.
Google open-sourced the opposite approach. Its Elephant-Goldfish Model plugin, used daily by thousands of Googlers, makes an agent write and defend a design document before any code. A long-running “Elephant” session holds the design, and stateless “Goldfish” reviewers with no shared context must explain it back and then attack it. “AI-powered velocity is transformative; however, it has silently introduced a potential reliability crisis,” the team writes. Security is not a default review target, so teams need to add a threat-review persona. Google also opened Android Studio to more than 40 third-party coding agents through the Agent Client Protocol, with access to project structure, the emulator and Logcat, and shipped its Android CLI as a plugin for the major agent tools and CI.
Addy Osmani’s O’Reilly essay ties these together. When agents produce more code than people can read, quality has to live in the harness: layered tests, mutation testing, architecture rules in linters and pipeline gates that reject work early. If verification cannot keep up, you scale verification, slow the rate of change, or lower the bar. “Software quality now depends on the constraints you set around your agents.”
Sources: https://www.infoq.com/news/2026/10/anthropic-code-review/, https://www.helpnetsecurity.com/2026/10/26/google-elephant-goldfish-model-plugin/, https://the-decoder.com/google-opens-android-development-to-third-party-ai-agents-and-unveils-new-gemini-apis/, https://www.oreilly.com/radar/agentic-code-quality/
8. Token bills, gateways and the wrong metric
The Register · October 26, 2026 · LeadDev · October 29, 2026 · DevOps.com · October 29, 2026 · The Register · October 31, 2026 · O'Reilly Radar · October 28, 2026 · Business Insider · October 31, 2026
Aiven, the Finnish open-source database provider, says moving its heaviest internal AI users onto open-weight models cut their token spend by about 80%. It built an internal gateway on a self-hosted LiteLLM, added budgeting and access management, and runs models on rented GPUs. Frontier models plan the work and open-weight models do most of it. “The majority of the work is actually done with open-weight, but the most critical bits of the work are planned with frontier models,” said VP of strategy Ville Lehto. Aiven tracks cost per task, not just tokens, and plans to sell the gateway as a service. A gateway that holds every provider key is also a high-value target, as this week’s LiteLLM postmortem shows.
In LeadDev, Nordhealth CTO James Stanier warns that per-seat plans are subsidised and per-token pricing would cost roughly ten times more for the same use. One well-known developer estimated a month of his usage at $2,180 at token rates against $200 in subscriptions. Anthropic’s Enterprise plan and OpenAI’s Codex on ChatGPT Enterprise have already moved toward metered pricing. His advice: make usage visible, match model and effort to the task, and “never rank engineers by tokens.” James Shore, writing on O’Reilly, reports one CIO’s top users spending about $21,000 a month each on tokens, and suggests modelling optimistic and pessimistic price scenarios.
Measurement is the other problem. A DevOps.com contributor calls token consumption the new lines-of-code metric, one that rewards bloated code and parallel agents doing simple work. An Amazon memo from a VP and Distinguished Engineer, circulated internally in September and now public, calls input metrics “deeply flawed” and says “If your work does not benefit from current AI tooling, that is a finding, not a failing.” Corey Quinn’s column argues the memo still lets managers read adoption data both ways, and notes that Amazon shut an internal token leaderboard in May after staff gamed it. At Proton, the CTO’s manifesto told engineers their job is now to help the model write better code, and reporting by 404 Media describes staff who felt unable to raise security concerns about AI-written code. Pressure to ship AI-written code faster is a security-review issue as much as an HR one.
Sources: https://www.theregister.com/ai-and-ml/2026/10/26/euro-open-source-specialist-proposes-llm-gateway-to-ease-token-bills/5305170, https://leaddev.com/ai/cheap-ai-tokens-are-running-out, https://devops.com/the-return-of-a-bad-engineering-metric-when-ai-token-usage-becomes-performance-theater/, https://www.theregister.com/ai-and-ml/2026/10/31/amazon-sends-chills-through-its-workforce-with-mixed-message-memo-about-ai-use-corey-quinn/5306804, https://www.oreilly.com/radar/are-you-getting-your-moneys-worth-from-ai/, https://www.businessinsider.com/protons-cto-ai-manifesto-software-engineers-coding-2026-10
Calls to action
- Revoke, don’t just delete, any secret that has touched a public commit. Removing a commit does not invalidate a key. Scan history for exposed secrets, rotate them, and if you ran LiteLLM 1.107.0, treat every credential on that host as stolen.
- Audit which tokens your agent platforms and automation hold. List CLI and OAuth tokens with organisation-wide or owner-level access held by bots, agent platforms and CI. Scope them to single repositories and short lifetimes, and alert on their use from new locations.
- Fix workflows that run on issues, comments and pull requests. Never interpolate event text into shell steps, run externally triggered workflows without secrets, and keep privileged jobs in separate workflows.
- Add a dependency diff to every pull request. Require an owner to approve new package names and publisher changes, and test uncertain packages in disposable environments with no production secrets.
- Publish an intake standard for AI-assisted security reports. Ask for a reproducer and a report one person can read, add duplicate detection to triage, and say in your policy whether contributors must disclose AI use.
- Split finding from validating when you use AI on your own code. Use a separate agent or run to validate findings, never merge an AI patch without automated tests and human review, and turn each fix into a regression test or rule.
- Generate, validate and sign SBOMs at build time. Use SPDX or CycloneDX, store the signed SBOM next to the artefact, and control who it is shared with.
- Tier merge gates by risk, and make sure an agent approval never counts as a human one. Define which change types need zero, one or two human reviewers, and cap automated review rounds.
- Inventory MCP servers and move them to managed authorization. Replace personal tokens with centrally managed authorization where your clients support it.
- Put token spend per team on a dashboard, but never rank people by it. Track cost per task, route lighter work to cheaper or open-weight models behind spend caps, and model what metered pricing would cost you.
|