One safety story a week, pressure-tested for what's actually happening underneath the surface.

By Lindsay Gross

On Wednesday the NSA told organizations running PHP to patch immediately, and to take the system offline if they couldn't. Researchers found the bugs behind that warning with a lot of help from AI. The same day, attackers used LiteLLM's own release pipeline to ship a credential stealer to the developers who rely on it to call AI models.

The PHP half is the story everyone’s telling. Security firm Calif found the flaws in August using OpenAI’s GPT-5.6 Sol, and Wiz confirmed them independently with Gemini 4 Argon, GPT-5.6 Sol, and its own Wiz Atlas agent. Wiz says “a single researcher completed in a week what previously would have taken a world-class team months of work.” Wiz researcher Sagi Tzadik wrote that the flaws affect every PHP version released over the past decade.

LiteLLM is a proxy that sits between your app and those same models and routes each call to whichever provider you’re paying. Socket counts about 23 million downloads a week. For about two hours on Wednesday, version 1.107.0 on PyPI carried malware built to grab cloud credentials, API keys, SSH keys and .env files, and the same payload sat in LiteLLM’s Docker images, including the latest tag, a little longer. It ran any time Python started, even if your code never imported LiteLLM, and it also loaded tools that let the attacker run code remotely.

LiteLLM’s incident post is unusually candid about how it happened. An internal LiteLLM deployment was exposed to the public internet, and the team believes the attacker got into it and pulled GitHub CLI tokens out of its logs. Three developer credentials later, a poisoned release was live. In the same post, LiteLLM says it found that “Claude Code will embed a user’s GitHub CLI OAuth token into a response body, and in situations where response bodies are logged, these tokens may appear in LiteLLM logs.”

LiteLLM believes that’s how the tokens ended up in the logs the attacker read, though it describes that as its best understanding, not a confirmed finding. Either way, it means one AI tool can hand a key to another AI tool that writes it down, which is an uncomfortable way for a secret to travel.

This is also LiteLLM’s second compromise this year. In March, attackers got in through Trivy, a vulnerability scanner in LiteLLM’s build pipeline, meaning the security tool was the way in.

If you or your team use LiteLLM, its developers say to go back to version 1.106.2, the last clean release. If 1.107.0 ever ran on a machine, including through the latest, main-latest, or main-stable Docker tags on the morning of October 21, assume every key and password that machine could read was stolen. Replace them, and rebuild the machine, since the malware also loaded remote-control tools.

On Monday, October 19, we launched The AI Collective Podcast, a live show every weekday at 9 AM PT hosted by AJ Green and Catherine McMillan. The idea came out of Tech Week, where we kept walking out of conversations with founders, builders, and investors that only the people in the room got to hear. Nearly 100 guests were booked before the first episode aired, with leaders from OpenAI, Microsoft, Meta, Andreessen Horowitz, and NVIDIA among them.

Each episode mixes AI news, community updates, and guests. Thursday's episode brought on Shaun Zhang of Elixirr, Alejandro Cuauhtemoc of Silicon Valley Certification Hub, and Rajat Suri of Tribe. Catch it live on LinkedIn, YouTube, X, and Instagram, and if there is a founder, builder, or investor you want on the show, tag them in the comments of the launch post. Self-nominations count too.

On Thursday, October 22, we co-hosted Multimodal Engineering Night in San Francisco with Superoptimal, Upriver AI, and Code & Coffee. Space was capped at 70 and registration filled up ahead of the night. The lineup featured engineers running multimodal systems in production: Wenchi Ma of Walmart Global Tech on shrinking vision-language models for edge devices, Joe Tam of Upriver on finding the same TikTok trend across millions of clips that look nothing alike, Harish Wajjala of Roblox on understanding 3D scenes without rendering them, John Kupchanko of Qdrant on an agent that beats video games with vector search, Caroline di Vittorio of LangChain on evaluating voice agents, and Joe Meyer of SAP on multimodal models for databases.

The talks shared one thread, AI working with more than text, from game state and 3D assets to voice and the numbers sitting in business tables. Caroline's talk was built around grading a voice agent on whether it follows instructions and uses tools correctly, whether it reaches its goal, and whether the conversation flows without awkward pauses. If you're building something multimodal, keep an eye on upcoming SF meetups on our events portal.

Our partners and sponsors get exclusive placements across the newsletter and access to AIC's in-person network — demo nights, dinners, hackathons, and forums across 180+ chapters.

For all inquiries, send us a note at [email protected].

The AI Collective is built by volunteers across 180+ chapters in 40 countries.

Thank you to the thousands of volunteers around the world who make this work possible. We truly could not do this without you.