|
Hey there 👋
I read four separate incident writeups this week, and they all pointed the same way. For about a year, the smart move has been to own your agent runtime. Self-host the engine. Run your own gateway. Keep the models close so nobody could snoop on you or bill you blind. Good instinct.
This week showed the flip side of it. The box you built to hold your agents also holds every key your agents ever touch. One poisoned package proved that in a single release. The next twelve months of agent security come down to one question: who gets to see the credentials.
- Ron
The Big Thing
Your AI gateway became a credential store
Someone pushed a poisoned build of litellm to PyPI and Docker on October 21. Version 1.107.0 shipped as seven wheels plus a tampered source archive. If you pulled it, the package went hunting through your machine. It grabbed cloud tokens, developer credentials, private keys, the credential files your AI tools leave on disk, browser data, and the proxy's own stored secrets and model tables.
That last part is the gut punch. Your gateway keeps a copy of every key it routes, and the malicious build scooped those up too. Then it shipped everything to a lookalike domain dressed up as a health check. It dropped a file to survive reboots and ran an hourly job that phoned home through GitHub.
How did a bad version get released at all? Attackers got into three of the project's accounts, an owner and two maintainers. One account kicked off the release. A second approved it. The investigation into how those first tokens were stolen is still open, so treat that as unknown for now.
A research note from CSA Labs on October 23 widened the lesson. The note explains the mechanism: Claude Code can embed a user's GitHub CLI OAuth token in a response body, so any gateway that logs response content writes that token to its logs in plain text. LiteLLM believes an internet-exposed internal deployment did exactly that. Content logging flips on with a single setting called store_prompts_in_spend_logs, and the controls meant to keep secrets out of logs have not always been reliable. So the keys land in plain text and sit there waiting.
The fix this week is boring and urgent. Pin 1.106.2, and pin it by digest so nobody can swap the tag under you. Rotate everything the proxy could see, and do it from a clean machine. That means IAM roles, provider keys, your master key, every virtual key, and the database password. Then grep your gateway logs for GitHub token shapes, gho_, ghp_, and github_pat_. Anything you find is burned. The poisoned PyPI package is quarantined and the bad Docker tags are pulled, so a fresh pull is safe once you pin.
Two things to sit with. This is the second LiteLLM compromise this year. And the control plane we built to make agents auditable turned out to be the single richest place to rob.
Why it matters: if you log coding-agent request and response content through any gateway, assume your credentials are exposed and rotate them today. Verdict: DEPLOY the remediation now.
Sources: LiteLLM incident report, The Register, The Hacker News, CSA Labs.
Tour de Headlines
💰 Daytona raised a $60M Series B at a $1B valuation, led by FirstMark Growth. The pitch is simple. Each AI agent gets its own sandboxed machine, so it can grind on long jobs without stepping on anything else. Founder Ivan Burazin calls it "like giving every agent its own computer." That makes Daytona Croatia's third unicorn. The part worth watching is where the money went. A year ago this round would have funded a model. Now it funds the place the agent runs. I could not reach Daytona's own post on the raise, but Fortune, TechCrunch, and Dealroom all line up on the numbers. Verdict: PILOT. TechCrunch
🔑 1Password shipped a credential trust layer for agents on October 22, with 14 launch partners. It gives an agent a digital key that proves who it is. When the agent needs to log in somewhere, you get a prompt, and only after you approve does 1Password fill the credentials. The agent gets in without ever seeing the password. That is the direct counter to today's Big Thing. If the key never enters the pipe, a poisoned gateway has nothing to scoop. It already works with Claude Duet, ChatGPT Work, and others. One caution: the launch framing is about "personal AI agents," so confirm it covers enterprise and programmatic use before you lean on it. Verdict: TRY. TechCrunch
🖥️ Agent multiplexers are the quiet layer filling in this quarter. If you run more than one coding agent at once, you know the pain of babysitting a wall of terminals. A small crop of tools is growing up to fix it, call it tmux for your fleet. herdr is a Rust, terminal-based one. Corgi showed up on Show HN as an agent and terminal multiplexer at corgi.computer. caw is making the rounds on Product Hunt. The fun part is what this tells you about output. The orchestration layer is where solo builders are stacking real output this quarter. One heads-up on herdr: several forks are floating around, so search for the live repo rather than trusting the first link you see. Verdict: TRY. Show HN
|
Sponsor
Your team's calls are full of signal. RapportScore reads it.
RapportScore scores how your team communicates on real recorded calls and coaches them on it, so you can see where rapport holds and where it slips. Built for B2B teams who live on the phone.
See your team’s score →
|
Tool of the Day
🦀 Respan
An open-source, self-hostable LLM gateway with a small Rust core and compiled plugins.
Respan came out of YC's W24 batch, from maintaining a heavily modified LiteLLM fork. The team got burned by an upgrade they could not see into, and rebuilt on an Nginx-style design: a small core, with everything else living in plugins. Plugins handle providers, routing, MCP tools, realtime voice, and security. It can even translate protocols, say an OpenAI Realtime client talking to Gemini Live. Be clear-eyed though: it is pre-alpha, and custom plugins have to be compiled into the binary. Evaluate it, keep it off real traffic for now, and treat the timing against this week's breach as a reason to look, not a reason to switch. Verdict: WATCH.
Clone Respan on GitHub →
Worth a Click
- How gateway logs became a token-compromise path: the CSA Labs research note behind today's Big Thing. If you run any AI gateway, read how a logged GitHub token can get written to your logs in plain text, then go check your own log settings.
- Scrawl records what your agent can't see: Kit Langton's tool captures your screen, voice, and clicks and packages all of it as context for a coding agent. It is a fix for the moment the agent has no idea what you are staring at. Single-author project, so check that it is publicly usable before you count on it. Verdict: TRY.
The money is crowding into the agent runtime with Daytona, and so are the defenses with 1Password and Respan, all onto the same surface the LiteLLM attackers walked through. My bias: decide how your agent gets its keys before you decide where it runs.
Go rotate your keys first. The changelog will still be there in ten minutes.
- Ron
| 
