AINewsnow

Supply Chain Attack Delivers Malicious Claude Extensions and Poisoned LiteLLM Release

A supply chain attack placed malicious Anthropic Claude extensions on thousands of devices, while a poisoned LiteLLM 1.107.0 release on PyPI and Docker Hub stole AI keys for about two hours on 21 October 2026.

Read the full story at Wired AI ↗

Timeline · 2 reports

  1. 2026-11-01 13:00 · DEV Community — AI
    LiteLLM Supply Chain Attack: How Poisoned Version 1.107.0 Stole AI Keys, and How to Check Your Systems
  2. 2026-10-30 20:38 · Wired AI
    A Supply Chain Attack Put Malicious Anthropic Claude Extensions on Thousands of Devices

More stories

  1. Anthropic files for blockbuster IPO as Blackstone flags likely junk rating — New York Times Technology
  2. DeepSeek open-sources dsh-superagent, a proactive coding agent prototype — Bloomberg AI
  3. Anthropic renames Claude Max plans and drops Ultra's five-hour usage limit — Anthropic (X)
  4. Anthropic hiring shifts as manager drops coding interviews and IPO questions probe candidate motives — Fortune AI
  5. Anthropic adds server-side rule blocking Claude Code from recreating existing games — Sam Altman (X)
  6. Malicious Claude Code extension on Cursor marketplace planted SSH backdoors for 11 hours — Microsoft Research Blog
  7. Anthropic research explores automating detection of subtle emergent misalignment — Anthropic (X)
  8. Contractor's Personal Claude Agent Ran on Pentagon Network for Two Months — Wired AI

Get the daily brief of stories like this at 6:30 every morning →