On October 21–22, 2026, four incidents at the intersection of AI and infrastructure converged. CrowdStrike described four groups of attackers who, from May to August, used AI agents, including Claude Code, to independently execute attack steps. A parallel story: the GPT-5.6 Sol model, as part of the OpenAI "Patch the Planet" initiative, helped find critical vulnerabilities in PHP that had existed in the language's code for over two decades. Simultaneously, attackers compromised the LiteLLM release pipeline, causing a malicious version of the package to reach official registries, while the Railway platform reported a potential leak of secrets from environment variables.

image
image
image

What happened

On October 21, attackers compromised the LiteLLM release pipeline: the malicious version 1.107.0 contained code for credential theft and remote code execution (RCE). The package remained available on PyPI for about two hours and in Docker registries for about two and a half hours; version 1.106.2 is considered safe. CrowdStrike simultaneously published an analysis of four campaigns from May–August 2026, in which AI agents, including Claude Code, independently selected and executed actions in attacks; they completed the full kill chain in approximately one hour, and in one of the campaigns, more than 15 healthcare organizations in Argentina were compromised. As part of the OpenAI "Patch the Planet" initiative, researcher Calif, using the GPT-5.6 Sol model, found critical PHP vulnerabilities that have been present since version 5 from 2004; Wiz independently found them, and the NSA recommended updating PHP to 8.5.12 or temporarily disabling sites. The fourth incident is Railway: the platform reported a potential leak of secrets from environment variables, including decrypted API keys and database passwords.

Context

The background here is more important than the loud headline. LiteLLM is the de facto standard gateway to LLM providers, so a hack of the release pipeline hits the serving stack of many applications, not just abstract "AI in general." October 2026 for the first time brought together field data on agentic AI from both sides in one window: the CrowdStrike report is about agents on the attackers' side, while the "Patch the Planet" case is a model that found an error in real language code that humans had missed for years, meaning it is not a synthetic security benchmark. However, two of the four incidents do not require the "AI is attacking" hypothesis: LiteLLM is a classic supply chain compromise, Railway is a platform secret leak, and it is useful to separate these events when assessing risks. The difference in exposure of the malicious LiteLLM version on PyPI and in Docker registries is also indicative: the speed of catalog response is already comparable to 0-day response, but artifact mirroring extends the life of malicious code, and the time to package removal (time-to-takedown) is a measurable metric suitable for public registry SLOs.

Why this matters for the industry

Two opposing signals are important for the industry. Agents have become a working tool for attackers, so when modeling threats, their campaigns should be distinguished from classic incidents: they have a different profile of autonomy and speed of action. Simultaneously, LLM-assisted auditing has ceased to be a demo: if the methodology of the "Patch the Planet" case is published and re-confirmed, such auditing could become a mandatory stage for maintainers of large open-source projects, and programs in its spirit could be replicated. For infrastructure, this means stricter requirements for dependency provenance: signed artifacts, lockfiles, mirrors, and more cautious automation of updates in the serving path, as well as public SLOs for the time to remove malicious packages from package registries. An expected consequence will be increased demand for agent security tools: permission managers, sandboxes, agent action audit logs, and automatic secret rotation are becoming a purchasable category. For startups, all this means an immediate increase in overhead costs: inventory of agent and CI pipeline privileges, dependency integrity checks, and isolation of agent environments.

Why this matters for users

Readers with real environments should run through three checklists. For LiteLLM: ensure that version 1.107.0 from the window of 11:39–13:23 UTC on October 21 is not installed, pin to 1.106.2, and check for traces of credential theft; if the affected version was installed, LLM provider keys and tokens need to be rotated. For Railway: rotate all secrets in environment variables, starting with LLM provider keys and database passwords. For PHP: update to 8.5.12, and if a quick update is not possible, consider temporarily disabling the site, as the NSA advises. A separate point is for everyone who runs AI agents with access to code and infrastructure: least privilege, environment isolation, and human-in-the-loop for destructive actions have ceased to be over-caution and have become basic hygiene.

What is currently unknown / limitations

CrowdStrike's assessments are vendor statements: public materials lack telemetry, agent prompts, and an explicit scheme of human involvement, so the statement that agents autonomously pass the kill chain in approximately one hour should be read as a signal of threat direction, not as a reproduced scientific result. For the GPT-5.6 Sol case, the sources have not yet disclosed the selection methodology and the false positive rate of LLM auditing. Long-term scenarios—reducing the lifetime of old vulnerabilities from decades to weeks by 2028 and "least privilege by default" for agents as a product norm—remain interpretations and require independent verification.

Sources

Author

Look at AI, editorial team