#134 - Keys, Not Bugs: How a Leaked Key Poisoned LiteLLM and AI Agents Hit 2,250 Tenants

The loudest story this week was a pair of PHP bugs. The one that matters more to you started with a configuration file.

On 27 May, a config file committed to a public LiteLLM repository contained the master key for a deployment of its Agent Platform. Nobody revoked it. On 10 October an unknown attacker used it, pulled out a GitHub CLI OAuth token tied to the organization owner's account, pushed credential-harvesting workflows from throwaway branches, overrode branch protection and repointed the release pipeline at a lookalike repository, Berri-AI instead of BerriAI. On 21 October, version 1.107.0 went to PyPI and Docker Hub. A .pth file runs the stealer every time Python starts, even if nothing imports LiteLLM, and a second payload polls a GitHub dead drop hourly for new code. The loot is browser sessions, AWS, GCP and Azure credentials, SSH keys, and the API keys for OpenAI, Anthropic and the rest. PyPI quarantined the release within roughly 80 minutes of a researcher report. The key had been exposed for more than four months.

No exploit was written. Nobody found a bug. The attacker found a secret that never expired and walked from it to a release pipeline. LiteLLM is also the layer where developers keep the keys to every model provider, so one poisoned release collects several accounts at once. If you ran 1.107.0, or pulled the latest, main-latest or main-stable Docker tags, assume the secrets are gone.

The second half of the signal shows what AI adds once an attacker holds a credential. Microsoft attributes the ConnectWise Cloud Backup compromise to Storm-0940, a China-aligned group, which used the open-source ARTEX agentic pentest framework to automate password spraying and OAuth abuse against customer tenants. The Register counts 2,250 Microsoft 365 tenants in the blast radius. Microsoft saw 111,000 failed logons on 11 October alone, at up to 2,900 attempts a minute. SecurityWeek reports successful access to over 300 accounts in eight organizations, with agents then reading Microsoft Graph, adding application credentials for persistence and editing privileged roles. Some victims reached privileged cloud access in under three hours. Microsoft's own summary is honest: the majority of the targeting wasn't successful, and the actor still achieved privileged persistence at many organizations.

Read the two together. The AI did not need a zero-day. It needed a valid credential and a tenant that let it move quickly. ARTEX's developer says the project will go closed source after the misuse, which will not put the code back in the bottle.

Sources: The Hacker News (LiteLLM master key), The Hacker News (LiteLLM compromise), The Register (LiteLLM), The Record (ConnectWise and ARTEX), The Register (2,250 tenants), SecurityWeek (ARTEX).

80% of product professionals say AI helps them ship faster, but customers aren’t seeing value any sooner. Atlassian’s State of Product 2027 explores the gains AI is delivering and the challenges that remain, from decision-making that hasn’t kept pace to gut instinct overriding customer evidence.

Read the report

PHP2Shell took 18 of the 50 critical-rated articles in the Overwatch pipeline this week. Dozens of UK government services went offline as a precaution, and the two bugs, CVE-2026-109618 and CVE-2026-109619, are CVSS 9.2 unauthenticated RCE reaching back to PHP 5.4. AI review tools helped find them. All of that is real, and you should patch.

It does not describe a mass compromise. VulnCheck told The Register it has seen hundreds of proof-of-concept repositories and that very few contain legitimate, working exploits. CrowdStrike went through the public ones, found crash PoCs that only prove a vulnerability exists, and has seen no successful exploitation in the wild or its honeypots. Sophos retracted a report of successful exploitation and now says it saw a small number of failed attempts. Cloudflare's counts of millions of attempts measure requests, not compromises.

Don't read that as safety either. Amazon saw attempts from 17 October, four days before the patches, and could not say whether any worked. VulnCheck has a working ASLR bypass and sells it. A third flaw, CVE-2026-115560, has a mitigation and no emergency patch.

The useful comparison is the quieter story. Plex2Shell chained four Plex Media Server bugs, and a researcher published a working chain on 16 October. Attackers were installing miners and a proxy backdoor within a day. No government pulled sites offline, yet it has confirmed exploitation and PHP2Shell does not. Headline volume and real risk moved in opposite directions this week. The real risk was in the keys above.

The shift is that the secret is now the vulnerability, and AI shortens the distance from a secret to a breach. Last week's Vulnerability Trap argued that patching speed alone loses to attackers who skip the vulnerability. This week gave the confirmed cases: a master key at LiteLLM, connection keys at UpdraftCentral, vendor credentials at ConnectWise, a single compromised login at the testing nonprofit ETS that exposed records on millions of California students for four months before discovery.

AI changes the economics on both sides of that line. On offence, the Cairn campaign The Hacker News described ran more than 1,100 attack projects at about $5 a task with roughly a 10% success rate, about $50 per successful hack, and left exposed panels that leaked hundreds of credentials. ARTEX turned the same economics on stolen cloud identities. Cheap attempts are tolerable when your credentials are short-lived and scoped. They are expensive when a token lives for months.

The other direction is that we are now handing agents keys of their own. V12 found 25 flaws in the x402 payment SDK for agents, including a default client with no spending limit that let a malicious API ask for an agent's full balance. METR and Redwood reported that OpenAI's monitoring of its own agents was not fit for purpose, with about 10% of eligible Codex traffic unmonitored during context compaction. Provider-side monitoring is not a control you can count on. There is one hopeful note. Tracebit's context bombs, fake targets planted for attacking agents, cut success rates by up to 91% on one frontier model and pushed cost per success up to 23 times on others. Deception is a cheap way to tax an attacker that runs on volume.

Over the next two to four quarters, expect identity hygiene (short-lived tokens, workload identity, inventory of every machine and agent credential) to become the control board members ask about, and expect agents to join your identity inventory whether you plan for them or not.

Our biggest exposure this week was a long-lived key rather than an unpatched bug, so I'm asking the board to back a programme that measures the age and scope of every machine credential we hold, with AI agents counted in.

It was a hard week. A PHP emergency, a poisoned AI dependency, an MSP breach and a CVSS 10 landed within days of each other. To everyone who carried that:

To the sysadmins and platform teams who inventoried every PHP install, including the ones buried in appliances, and to the teams who pulled services offline for a few hours rather than gamble.

To the researchers who were honest about what they saw. Sophos corrected its own report, CrowdStrike explained why it had not seen exploitation, and Amazon shared its honeypot data. Calibrated reporting is a favour to every SOC downstream.

To the maintainers and vendors who moved fast: PyPI quarantining LiteLLM within hours, ConnectWise suspending services, TeamUpdraft rotating keys, the PHP team shipping fixes for four branches.

And to every analyst, responder, vulnerability manager and CISO who spent the week answering "are we exposed?" for a board that wanted a number. You were the control. Thank you.

Level 4 - AI Created, Human Basic Idea / The whole newsletter is generated via Claude workflow based on hundreds of news and research articles. Human-in-the-loop to review the selected articles and subjects.

Reference: AI Influence Level from Daniel Miessler

Project Overwatch is how a CISO gets ready for what is coming. Every week, the signal across cybersecurity, AI, and resilience, filtered down to what changes your decisions, by someone who actually does this job. Not breaking news. Foresight you can act on.