Humanbound's engine and CLI are open source: github.com/humanbound/humanbound
LiteLLM 1.107.0 shipped to PyPI and Docker with a credential stealer, disclosed on 21 October. It is the second documented LiteLLM hijack this year. Add the OpenCode Console key breach (19 October) and a steady drip of coding-agent sandbox flaws, and the pattern is clear: attackers go after the place agents keep their keys.
What happened to LiteLLM
All seven platform wheels of litellm 1.107.0 included cook.pth, cook.py and sitecustomize.py. The .pth file runs at every Python startup, so the stealer executes even if your app never imports litellm (JFrog). It collects SSH and GPG keys, browser data, cloud and Kubernetes credentials, CI/CD secrets, AI tool credentials, environment variables and the LiteLLM tables that hold provider credentials, then posts them to a look-alike domain (JFrog, The Hacker News).
A second payload polls a GitHub dead drop every hour and can fetch and run remote code. JFrog found the dead drop empty, so it was dormant, but the file can be changed to re-arm it.
How it got into the release
LiteLLM's director of security said the malicious actions ran through three engineers' GitHub accounts, apparently using stolen GitHub CLI OAuth tokens. How the tokens were obtained is unknown and the investigation is ongoing. JFrog notes the sdist's pyproject.toml differed from the matching git tag, so reviewing source and tags alone would have missed it.
This is not the first time. In March 2026, versions 1.82.7 and 1.82.8 were published after a compromised Trivy action exposed publishing credentials. JFrog found no evidence linking the two incidents.
Different attack, same target: the key store
OpenCode said attackers broke into an older system behind its Console on 19 October. 1.4% of Console users were affected, and developers reported unauthorized charges on OpenAI, Anthropic and Google accounts, some in the hundreds of dollars and a few above $1,000 (TechCrunch). OpenCode says its open source app and CLI were not affected and the incident is ongoing.
Different attack, same prize: provider API keys held in one place.
Agent tooling keeps leaking at the edges
Adversa's October roundup lists GitSpawn (git config execution sinks across several coding agents, with four of eight flaws unpatched at publication), Plugin4Shell, Codex sandbox escapes and a DeepSeek Harness sandbox escape tracked as CVE-2026-82533. The page does not state disclosure dates, so treat the list as a map of where the boundary is thin, not a timeline.
On the offensive side, OWASP's LLM Exploit Generation Guide 2.0 (27 October) offers a sober read: agents lowered the skill needed for discovery and vulnerability research but did not reliably deliver full autonomous compromise, and provider guardrails stopped the final action on one test machine (via GBHackers).
What to do on Thursday morning
- Check for litellm 1.107.0 anywhere you build. If found, revoke and replace credentials from a clean environment, and pin 1.106.2 by digest.
- Pin by hash, not by tag, and diff built artifacts against source.
- Scope gateway keys per agent and per task so one theft is not every provider.
- Test the agent, not just the pipeline: what can it reach with the keys it holds, and what happens when a tool result lies to it?
Test your own agents
Humanbound's engine and CLI are open source. To run adversarial tests against your own agents, sign up for the free Community plan at https://app.humanbound.ai.
Top comments (0)