Nothing in this chain looked like malware until the package shipped. Credential misuse looks like normal access from the wrong place. A maintainer’s token and the owner’s pushed from one IP five seconds apart. Baselines on who uses what, from where, catch that.
Every developer laptop now holds keys for the agents running on it. The question for your team is how many credentials that laptop can reach, and which of them an agent can use on its own. The full research and remediation steps: cyera.com/research/litellm-c…
AI isn’t about automating ALL work. But the boring stuff? Absolutely.
Legal built 20 playbooks that give every inbound vendor NDA a first review. That’s one of the use cases Joe Tustin walks through in Machine Learnings, an inside look at how we got 90% of our 1,800 employees using AI every week.
Watch for two more of his favorite use cases, and read the first story: cyera.com/blog/your-legal-te…
🤖 Made with AI
Third year in a row on the #Cyber60, and we’re thrilled! Thank you @lightspeedvp and @FortuneMagazine.
Every company wants to say yes to AI, but they can’t until they control what every human, machine, and agent can access. That’s the problem we get up for every morning.
The 4th annual Cyber 60 list is here.
This year’s list recognizes some of the fastest-growing venture-backed cybersecurity startups in the market, building to advance next-gen infrastructure, AI security, and how we approach threat detection.
Congratulations to everyone who made the #Cyber60 list in partnership with @FortuneMagazine and sponsor @AWSstartups.
Read our full CISO survey report, conducted with Wakefield Research, which polled 200 CISOs on enterprise AI and where they’ll invest next: lsvp.com/cyber60-2026-2027/
A poisoned LiteLLM release was live for about two hours on Oct 21 and stole credentials from every machine that installed it.
The attacker never exploited a vulnerability. It started with a master key in an agent config that was pushed to a public repo in May.
The commit was removed, the key was never revoked, and it stayed valid for four and a half months. From there, the chain ran through a GitHub org owner’s CLI token, two CI workflows that pulled about 20 secrets, and a release that looked legitimate.
If you installed litellm 1.107.0:
➡️ Follow LiteLLM’s cleanup guidance
➡️ Rotate everything that host could reach, and rebuild from a clean machine
➡️ Hunt for credential use since 11:39 UTC on Oct 21
The payload ran at every Python start, even in processes that never imported LiteLLM. It took cloud credentials, SSH keys, .env files, shell history, and LLM provider keys.
If you didn’t install it, check what your own coding agents have in their configs today.
Full breakdown: cyera.com/research/litellm-c…
Federal agencies are under pressure to adopt AI. To do it, they also need industry-leading AI security to protect the country's most sensitive data.
We’re excited to help federal agencies meet these dueling mandates with the leading trust platform to secure data, identities, and AI. Today, @cyera_io earned FedRAMP High (Class D) Certified status, FedRAMP’s highest bar.
We started working toward the certification before we even had a sponsor, and we did it in under five months. All to get this platform in the hands of federal agencies as quickly as possible.
“This approval process set a high bar, proving how we secure the platform, how we operate it, and how we respond under real scrutiny. That same rigor carries over for every customer we serve,” said Lamont Orange, @cyera_io's Chief Trust Officer.
Read how we got here: cyera.com/blog/cyera-can-hel…
Earlier today, OpenCode said external AI provider keys linked to affected Console workspaces may have been exposed. Some users are already reporting charges they didn’t make.
4 actions to prioritize:
• Ask your developers whether they received a notice from OpenCode
• Revoke and reissue impacted keys directly in OpenAI, Anthropic, Google, and other provider dashboards.
• Investigate unusual usage and set spend limits and alerts immediately.
• Map every key to an owner, the tools it powers, and the data it can access.
The broader lesson: AI agents and coding tools increasingly operate with credentials that can spend money and reach sensitive data. They need the same controls that are standard for any other privileged identity.
We’re updating our guide as the story develops: cyera.com/research/opencode-…
The phishing email of 2027 might not come from a stranger. It could come from your own trusted AI agent, in its own voice, saying your session expired.
We lived with an OpenAI dot for a week and a half. Here's what it can reach, and how to lock it down: cyera.com/research/dots-a-do…
A phishing campaign gets victims through a real Microsoft login and real MFA. No stolen password required. What the attacker does with that session next doesn't look like malware. It looks like tech support.
The victim gets redirected to a page impersonating Adobe Acrobat and Creative Cloud. The URL uses Cyrillic characters that look identical to Latin letters. At a glance, it reads as a normal Adobe domain. It isn't.
The relay infrastructure we identified: instance-ufa9fu-relay.screen… and instance-qlcyj5-relay.screen…, both outside any instance a normal company would sanction.
Nothing here trips the usual alarms: no credential theft to flag, no odd code execution at the compromise stage. Just a signed tool, a config file, and a victim who thinks they updated a PDF reader.
8/ Full IOCs, file hashes, and the one detection method that actually works, from Assaf Morag and the @cyera_io Research team: cyera.com/research/authoriza…
