Morning digest: LiteLLM's poisoned release, OpenAI's reseller rule, and military AI

Morning digest for Thursday, Oct 22. A popular open-source AI developer tool shipped a password-stealing update for about two hours yesterday, and OpenAI says services that resell direct access to its models will need its approval starting Nov 20. Then a report on criminals running bank attacks with a team of AI agents, Kling 4.0 arriving in Adobe Firefly, nearly 2,000 OpenAI agents combing through brain data in 32 minutes, and Google DeepMind staff quitting over military work as a new UN forum on military AI opens today.

1. LiteLLM, a popular AI developer tool, shipped a password-stealing update for about two hours, and the attackers got in through leaked logs. LiteLLM is open-source software that lets apps reach many AI providers through one connection, so it often holds a team's API keys for all of them. Datadog says it gets about 23 million downloads a week. Early Wednesday, a poisoned version, 1.107.0, went out through LiteLLM's normal release system. It was on PyPI, Python's main package library, from 11:39 to 13:23 UTC (4:39 to 6:23 AM PT), and in LiteLLM's official Docker images, including the "latest" tag, until 14:20 UTC. Wiz counts about 49,000 downloads of the bad version. Just starting Python on an affected machine runs malware that collects cloud logins, SSH keys, browser passwords, AI provider keys and the sign-ins for AI coding tools like Claude Code, Codex and Cursor, then sends them to a lookalike web address. LiteLLM says the attacker used stolen GitHub sign-in tokens from three of its engineers to point its release system at a lookalike copy of its code. It believes those tokens came from the logs of an internal LiteLLM server that was reachable from the internet, and says it has seen "specific situations" in which Claude Code put a user's GitHub sign-in token into a response that then got logged. Wiz says the attacker began testing stolen Amazon cloud credentials about four and a half hours later and checked which AI models those accounts could run. Earlier versions are safe, and LiteLLM recommends pinning 1.106.2. What this means for you: if you installed or updated LiteLLM on Oct 21 without pinning a version, or pulled its "latest" Docker image that morning, treat that machine as compromised. Don't run pip or Python there first, since that triggers the malware again. Delete the three planted files (cook.pth, cook.py and sitecustomize.py), rebuild the environment, then change every key and password it could reach, from a clean computer. Everyone else: pin exact package versions, and keep full AI responses out of logs where tokens can end up. (LiteLLM incident report, Datadog Security Labs, Wiz, GitHub issue)

2. OpenAI will require its approval for services that resell direct access to its models, starting Nov 20. On Wednesday, OpenAI published updated Usage Policies that take effect Nov 20. Anyone running "a model-access intermediary platform or other service that enables third parties to directly access OpenAI models" will need OpenAI's "prior review and approval." OpenAI's blog post says that covers services such as model routers and AI gateways, which give you one account for many AI providers. Apps that simply use OpenAI models to power their own features don't need approval. The update also spells out that you can't use OpenAI's models or their outputs to build training data, test tasks, scores or rankings for models meant to replace OpenAI's, though research, evaluation, benchmarking and product development are still allowed. Separately, OpenAI says it's working with customers on SafetyIDs, which let it tell individual end users apart during a misuse investigation without learning who they are. OpenAI didn't name any services or say how to apply for approval. What to watch: if you reach GPT models through a router service, watch for that service to say whether it has approval before Nov 20. If you call OpenAI directly from your own app, the approval rule doesn't apply to you, but check the training rule if you use GPT outputs to grade or train other models. (OpenAI, Usage Policies, OpenAI Help Center)

3. A security firm says criminals ran attacks on more than 400 Latin American banks and payment companies with a team of AI agents. Straiker published the report Wednesday, based on what it says is evidence from the group's own systems. It says CyberCartel, a group active since 2012 and now operating as Tr4nsHack Team, built a system called CARLIY0S on PentAGI, an open-source framework for automated security testing. Four Claude models with fixed roles debated each target, and one of them made the final decision. The group's commander was Claude running in the Cursor code editor, and five "Grok miners" gathered stolen secrets into a database that Straiker accessed on Sept 24, with 4,493 records. When Kimi or other backup models refused, the system switched to attack code written in advance. Straiker says the group got the models to help by describing its requests as authorized security testing or academic hacking exercises. It says Anthropic has revoked the credential the group used to reach Claude, and xAI is looking into the Grok activity. What to weigh: this is one security company's investigation, not a court finding. The practical point is scale: a small group could probe hundreds of targets at once, so if you run a site or app with an admin panel, keep it patched, put it behind strong logins, and don't expose it to the open internet if you can avoid it. (Straiker, Economic Times)

4. Kling 4.0 is now in Adobe Firefly, with 30-second clips and ten keyframes. Adobe announced it Wednesday. Firefly's partner model page lists Kling 4.0 Omni for image to video and video to video, with up to ten keyframes to set the beats of a shot, "Omni reference" to guide it, and clips up to 30 seconds long. Adobe lists it as available to individual Creative Cloud users only, not business plans. It costs 35 generative credits per second at 720p with audio and 50 per second at 1080p with audio, and video to video costs 40 and 60. Adobe says your content isn't used to train partner models. What to weigh: a full 30-second clip at 1080p uses 1,500 credits, so check your plan's monthly credits before you lean on it. The upside is having Kling next to Veo, Runway, Luma and Seedance in one app, so you can test the same shot across models without separate subscriptions. (Adobe partner models, Kling AI on X)

5. Nearly 2,000 OpenAI agents went through a mouse brain atlas in 32 minutes and turned up new research leads. OpenAI, the drug-discovery startup PerturbAI and Scripps Research said Wednesday that 1,946 agents running its GPT-Rosalind life-sciences model worked through existing data on how switching off individual genes changes millions of mouse brain cells. Each agent took one gene, studied the results, searched the scientific literature and proposed explanations, and their reports were combined into a public "reasoning atlas." The team estimates the same analysis would take people months to a year, a figure R&D World notes is built from assumed times per gene and per paper. In a test with the same model and resources, one agent handling the whole job cited about 11 references, while the distributed agents cited more than 700, and blinded experts preferred the distributed reports 75 percent of the time. One lead links a gene behind Perry syndrome, a Parkinson's-like disease, to cholesterol production in neurons. What to watch: these are hypotheses, not discoveries, and the work is a preprint that hasn't been peer reviewed. For builders, the pattern is the interesting part: splitting a big job into many small agents, each doing one piece, got much deeper results than one agent working through the whole job. (OpenAI, R&D World)

6. Google DeepMind staff are quitting over military AI work, and a UN forum on military AI opens today. The BBC reported Wednesday that Sofia Liguori, a London-based research engineer, resigned from Google DeepMind this week over Google's AI work with the US and Israeli militaries, saying it made her "ashamed to work at Google." Another researcher, Andreas Kirsch, resigned earlier this month, and current staff told the BBC that people fear retaliation for speaking out. Google said it follows "a consistent process" for reviewing these contracts and has "strict workplace policies in place to prevent retaliation." Google's Pentagon agreement allows its AI to be used for "any lawful government purpose," with limits on domestic mass surveillance and on autonomous weapons without human oversight. Today at 1 PM ET, the UN's disarmament research institute, UNIDIR, launches a forum on AI in peace, security and the military. It plans voluntary guidelines for companies that build military AI, a shared glossary of key terms, and work on misuse of AI by armed groups. What to watch: none of this changes the AI tools you use today. The question to follow is whether AI companies sign up to the UN guidelines, and whether more staff leave over military contracts. (BBC News, UN News, UNIDIR)