Cleared to Act #29

What

A poisoned LiteLLM release stole AI keys from everyone who installed it

On October 21, attackers published a malicious LiteLLM 1.107.0 to PyPI and Docker Hub; the release dropped three files into site-packages that ran every time any Python process started, even one that never imported LiteLLM, and the credential stealer exfiltrated cloud credentials, SSH keys, and AI provider keys to a lookalike domain while a backdoor polled a GitHub-hosted file hourly. The upstream source and git tag were clean, so every source-side check stayed green while the poison rode in the built wheels; PyPI quarantined the release within about two hours and the Docker tags followed. Deleting the package does not remove the payload, so Datadog and SafeDep both advise removing the three files by hand, reverting to 1.106.2, and rotating every credential that touched the machine. (Datadog Security Labs)

Fuzzing exposed 253 verified bugs across 118 MCP servers

Researchers from Penn State, the University of Montpellier, and Dartmouth published ToFu on October 9, a fuzzing framework that derives security checks from tool metadata itself; across 273 open-source MCP servers it found 253 verified bugs in 343 tools, spanning path traversal, SSRF, data exfiltration, and command injection. The bugs share one root cause: tools that document input semantics they never enforce, so a malformed model-generated argument reaches security-sensitive operations; the paper also demonstrates a "Repeat-After-Me" technique turning attacker text into executed tool calls across six orchestration frameworks including LangGraph and CrewAI. The authors state the conclusion plainly: a model-generated argument is not trusted input, even when it conforms to the schema. (arXiv)

GitHub admits its MCP registry checks names, not servers

GitHub's enterprise MCP controls include a "Registry only" mode meant to restrict Copilot to approved servers, but GitHub's own enforcement reference states the matching is based only on server names and IDs, which can be bypassed by editing configuration files, and that strict enforcement "is not yet available." GitHub's stated recommendation for the highest level of security is to disable MCP servers in Copilot entirely until strict enforcement ships. The registry gives you the approval record and the owners; the enforcement has to live somewhere the agent cannot edit. (Ecorp IT analysis quoting GitHub docs)

Why

Each story is a green check covering the wrong room. LiteLLM's release pipeline said clean because it looked at the source while the poison rode in the wheels. MCP tools describe input rules in their schemas and enforce almost none of them, which is why a fuzzer that reads the documentation found 253 verified bugs. GitHub's registry matches a name that the config file also controls and calls the result enforcement. The shared correction: a green check over an empty room is not evidence. Make every clean report state how many things it checked, and point it at the artifact that actually reaches production.

How

Make one green check in your stack name what it checked. Pick the control guarding your agent's riskiest action, an OAuth issuer check, a tool's input validation, or the artifact you installed this morning, and write down exactly what it verifies and how you would know if it stopped. A check that cannot say what it checked is not a check.