{"version":1,"type":"story","url":"https://digestai.news/story/litellm-1-107-0-compromised-developer-says-release-process-was-hijacke","json":"https://digestai.news/story/litellm-1-107-0-compromised-developer-says-release-process-was-hijacke.json","markdown":"https://digestai.news/story/litellm-1-107-0-compromised-developer-says-release-process-was-hijacke.md","slug":"litellm-1-107-0-compromised-developer-says-release-process-was-hijacke","headline":"LiteLLM 1.107.0 compromised, developer says release process was hijacked","summary":"A study from the Hong Kong University of Science and Technology and collaborators compared several code‑generation models. Claude Haiku 4.5 asked for clarification on ambiguous prompts at a rate of 38.3% to 44.5%, while DeepSeek‑v4 asked only 1.7%. However, the same study found that in 55.8% to 67.8% of executions the models touched the wrong files or made overly broad changes, a risk highlighted for solo entrepreneurs who rely on AI for site updates.\n\nSeparately, the maintainer of the LiteLLM library announced on October 21st that version 1.107.0 had been compromised during its release process. It is said to be designed to steal cloud credentials and even AI API keys. Users who have installed the affected version are urged to regenerate their API keys immediately, as stolen keys can lead directly to unexpected usage charges. The notice advises checking any in‑house or contractor‑managed deployments for the vulnerable version.","keyPoints":["Claude Haiku 4.5 asked for clarification on ambiguous instructions at 38.3% to 44.5% rate","DeepSeek‑v4 asked for clarification 1.7% but 55.8% to 67.8% of runs touched wrong targets","LiteLLM 1.107.0 was reported compromised on October 21st, potentially stealing cloud credentials and AI API keys"],"whyItMatters":"The findings expose reliability gaps in popular code‑generation models and a concrete security breach in a widely used AI‑call aggregation tool, prompting developers to tighten prompt design and credential hygiene.","category":{"slug":"agents","name":"Agents & Tools","url":"https://digestai.news/category/agents"},"entities":{"companies":["Hong Kong University of Science and Technology","LiteLLM","ITmedia NEWS","Security NEXT"],"models":["Claude Haiku 4.5","DeepSeek‑v4","Claude Code","Codex","OpenCode"],"people":["Masato"]},"firstPublishedAt":"2026-10-26T21:09:00Z","updatedAt":"2026-10-26T21:09:00Z","sourceCount":1,"hasPrimarySource":false,"sources":[{"outlet":"note.com","title":"[Morning Memo] AI proceeds without asking for clarification. Regarding Claude Code and LiteLLM","url":"https://note.com/masato_nomad/n/n80364c54bed2?hl=en","publishedAt":"2026-10-26T21:09:00Z","type":"press","primary":false,"lead":true}],"sourceNotes":null,"discussions":[],"thread":null,"cite":{"text":"Digest AI, \"LiteLLM 1.107.0 compromised, developer says release process was hijacked\", 26 October 2026, https://digestai.news/story/litellm-1-107-0-compromised-developer-says-release-process-was-hijacke","publisher":"Digest AI","title":"LiteLLM 1.107.0 compromised, developer says release process was hijacked","datePublished":"2026-10-26T21:09:00Z","url":"https://digestai.news/story/litellm-1-107-0-compromised-developer-says-release-process-was-hijacke"},"generatedBy":"Written by Digest AI's editorial model from the linked sources; the sources are the record.","license":"Headlines, digests and key points are written by Digest AI and may be quoted with a link to the story page. Linked articles belong to their publishers. Terms: https://digestai.news/terms#reuse"}