The Debrief·October 27, 2026·Read by 100K+ subscribers
Your LiteLLM Install May Have Leaked Your Keys
A poisoned LiteLLM release, OpenAI's new rule for gateways and a breaking Claude API version, then three cheap releases worth a test.
 |
News · No. 38 · Tue Oct 27 Check the Pipes Before You Try the New Models A poisoned LiteLLM release, OpenAI's new rule for gateways and a breaking Claude API version, then three cheap releases worth a test. |
Three things between you and your models changed last week, and one may already have your keys.
In This Email » LiteLLM 1.107.0 was poisoned on Oct 21: who is affected, and the 15-minute check to run today » OpenAI wants routers and gateways approved by Nov 20, and Claude's new API version breaks old code » Kimi K3.1 Pro, Voxtral 3 and Mercury 3, plus one claim to skip |
| The Big Thing: If LiteLLM 1.107.0 Ran, Your Keys Are Gone |
A Poisoned LiteLLM Release Stole Credentials for About Two Hours
LiteLLM is the open-source proxy many teams use to call every model through one API. On Oct 21, per its own incident report, a malicious litellm==1.107.0 was live on PyPI from 7:39 to 9:23am ET. The Docker images tagged v1.107.0, latest, main-latest and main-stable were compromised from 7:46 to 10:20am ET.
What It Did: per the OSV advisory, the package dropped a startup file that runs every time Python starts, even if you never import LiteLLM. It went after SSH keys, cloud credentials, environment variables and AI tool folders like ~/.cursor and ~/.claude, then sent them out.
How It Happened: LiteLLM says the attacker pulled GitHub tokens from the logs of an internet-facing internal deployment and used them to hijack its release workflow. Microsoft's analysis covers the startup-hook trick.
Why You Care: if you or anyone on your team ran an unpinned install or pulled one of those tags in that window, LiteLLM's advice is to assume the machine is compromised.
My Take: pin exact versions, never run latest in production, and treat your gateway logs as secrets, because that's where this attack started.
| Steal This |
The 15-Minute LiteLLM Check
- Search your lockfiles and Dockerfiles for
1.107.0, and for LiteLLM images onlatest,main-latestormain-stablepulled on Oct 21. - On any machine that might have it, run
pip show litellmand search forlitellm-1.107.0.dist-info,cook.pthandsitecustomize.py. Finding one confirms exposure. Not finding one doesn't prove you're clean. - If it's there, don't start with
pip install, because any Python start reruns the payload. Follow LiteLLM's cleanup steps, or better, rebuild from scratch. - Rotate everything that host could reach: every provider key stored in the LiteLLM proxy database, your master and virtual keys, the
DATABASE_URLpassword, any secret in the environment and the cloud role the machine used. - Pin to
litellm==1.106.2or another explicit version, and pin Docker images by version instead of a moving tag.
| Worth Your Time |
 |
Your AI Gateway Needs OpenAI's OK by Nov 20
OpenAI's updated Usage Policies take effect Nov 20, and they require "services that provide direct access to our models such as model routers or AI gateways to get our review and approval before offering that access," per its Oct 21 post. Partners must keep safeguards consistent with OpenAI's own.
Monday Use: if you reach GPT models through a router, a hosted gateway or a tool like OmniRoute from Friday's issue, ask your provider whether it is applying for approval. The post doesn't say whether a proxy you run only for your own team counts, so check before Nov 20.
Claude's New API Version Breaks Code That Sets Temperature
Anthropic's API version 2026-10-21 returns a 400 error if a request includes temperature, top_p or top_k, even at the default value. The new major SDKs use it, starting with Python 2.0.0. They also send your key as Authorization: Bearer instead of X-Api-Key, which can break a proxy that only reads the old header, and they move from the MIT license to Apache 2.0. Details are in the migration guide.
Monday Use: before you bump the SDK, search your code for those three parameters and check your gateway reads the Bearer header. A request that really needs a low temperature can stay on the old 2023-06-01 version for now.
Kimi K3.1 Pro Is Here at $2 Per Million Tokens
Moonshot released Kimi K3.1 Pro with a 1M-token context window. OpenRouter lists it at $2 input and $10 output per million tokens, or $4 and $20 for the Highspeed version, which Moonshot says runs 2-3x faster. Moonshot says the full weights come by Nov 4.
My Take: test it on a real coding task, but don't plan around open weights until they ship with a license.
Quick Hits
Mistral Can Now Price a Phone Agent by the Minute. Voxtral 3 ships with a voice agent SDK built on LiveKit for phone (SIP) and web (WebRTC) calls. The voice agent API is $0.04 a minute with Mistral Small 4, or $0.08 with a larger model.
Mercury 3 Is Fast and Half Price at Launch. Inception says its diffusion model hits 1,068 tokens per second on NVIDIA GPUs, its own measurement. Launch pricing is $0.10 input and $0.35 output per million tokens, half the list price, and the API comes with 100 million free tokens.
| Skip It |
Notion's "90% Lower Cost" Router Notion says its upgraded Auto delivered "similar results to Opus 5.5 and Astra at about 90% lower average cost" across 20+ use cases (Notion blog). That's Notion's own unpublished test, and Auto picks the model, not you. Nothing to change in your stack. |
Step-by-step lessons for tools like these live in the free AI Academy.
| Join the free AI Academy → |
Free, no card. The lessons behind Friday's tools live here.
That's the Debrief.
See you Friday for the tools.
From Drew and The AI Debrief team
P.S. Run the LiteLLM check and tell us what turned up, even if it's nothing. Hit reply, we read every one.
P.P.S. New here, or skipped one? Every past edition is in the archive.