If you run LiteLLM as the gateway between your app and whichever model provider you're paying this month, go check your version right now. On October 21, someone published a compromised 1.107.0 release to PyPI, and it made it into the official container images too. The attack itself is almost boring in how little it needed: stolen GitHub credentials for a maintainer account, used to repoint the release workflow at a lookalike repo, Berri-AI/litellm instead of the real BerriAI/litellm, with the hyphen doing all the work. A second compromised account rubber-stamped the production approval. From there the malicious package dropped a .pth file and a sitecustomize.py into Python's site-packages directory, both of which Python's interpreter runs automatically on startup. You didn't need to import litellm. Starting Python in an affected environment was enough.
What it actually stole is the part worth sitting with. This wasn't a credit-card skimmer bolted onto some npm left-pad clone. The collector went after Git credentials, cloud CLI configs for AWS, Azure and GCP, Kubernetes service accounts, Docker configs, SSH and GPG keys, browser credential stores, and specifically the config and auth files for GitHub Copilot, VS Code and MCP integrations. It also pulled rows straight out of LiteLLM's own proxy database. Everything got AES-256 encrypted with a fresh key wrapped in 4096-bit RSA and shipped out to a domain dressed up to look like LiteLLM's own. Microsoft's writeup is blunt about the fix: deleting the litellm folder doesn't remove the startup files, because they live elsewhere in the Python install, so the only real remediation is rebuilding the environment and rotating everything from a clean machine.
The reason this one stings more than a typical poisoned package is that LiteLLM sits in a position most dependencies don't. It's not a utility library three layers down your tree, it's the thing holding your actual model API keys, your database connection string, and your routing config, often on the exact developer workstations and CI runners that also hold the Copilot and MCP credentials the collector was explicitly hunting for. Compromise the gateway and you've compromised the keys to everything downstream of it in one move. That's what happens when infrastructure for AI tooling becomes load-bearing: it stops being just another dependency and starts being worth a dedicated typosquat campaign.
Two days earlier, Microsoft published a separate report that's the mirror image of the same shift: attackers using AI agents to do the breaking in, not just the building of what gets broken. Storm-0940, a China-aligned group that's been password-spraying and exploiting edge apps since 2021, has started running its intrusions through ARTEX, an open-source multi-agent penetration testing framework that drives reconnaissance, credential abuse and exfiltration with minimal human steering. Through a compromised ConnectWise Cloud Backup app, Storm-0940 used stolen app credentials, not stolen user passwords, to try signing into more than 2,250 Microsoft 365 tenants without a single interactive login. Some of those attempts went from first contact to privileged directory access in under three hours. One burst produced over 200 successful sign-ins in under four minutes using four application credentials.
Most of the targeting failed, and Microsoft is careful to say a successful sign-in doesn't by itself prove data walked out the door. Fair enough. But the number that matters here isn't the failure rate, it's the three hours. Security teams are built around the assumption that privilege escalation takes an attacker days to plan and execute, long enough for someone to notice the weird login and pull the plug. An agent framework that compresses that into an afternoon, and runs it in parallel across thousands of tenants at once, breaks that assumption at the root, regardless of how many individual attempts bounce off.
Against that backdrop, Anthropic's news from Thursday reads almost quaint, and that's a compliment. Agent Skills, the open format it published last December for packaging task-specific knowledge into a folder an AI agent can load, has been picked up by more than 70 platforms including ChatGPT, Cursor, GitHub Copilot and VS Code, with something like a million skills published and 280 million installs. Rather than keep steering that from the inside, Anthropic is donating the name, the GitHub org and the agentskills.io domain to the Agentic AI Foundation, the same Linux Foundation project already home to the Model Context Protocol, with engineers from Anthropic, Google and OpenAI maintaining it as individuals going forward. It's not a selfless move exactly, the standard already won before the donation, but handing off control of something that's working instead of squeezing it for leverage is rarer than it should be, and it's the one piece of good news to come out of AI infrastructure this week.