[dead]
My minute-by-minute response to the LiteLLM malware attack
181–190 of 194 posts
Re: My minute-by-minute response to the LiteLLM malware attack
#182Callum here, I was the developer that first discovered and reported the litellm vulnerability on Tuesday. I’m sharing the transcript of what it was like figuring out what was going on in real time, unedited with only minor redactions. I didn’t need to recount my thought process after the fact. It’s the very same ones I wrote down to help Claude figure out what was happening. I’m an ML engineer by trade, so having Cla…
As someone who works in security, it's really neat that you were able to discover this with the help of Claude. That being said the "I just opened Cursor again which triggered the malicious package" message is a bit eye opening. Ideally the instant you suspected malware that machine should have been quarantined and your security personnel contacted.
I get why you say this, but real life is messy and the "fog of war" makes situations far less obvious in the moment. The older I get the more I realize how much we need scrappy, can-do people who don't always follow the "rules". Knowing the "rules" and knowing that people follow the "rules" because "that's what your supposed to do" is itself an avenue for malicious actors to exploit.
Re: My minute-by-minute response to the LiteLLM malware attack
#183Earlier quoted context omitted.
Dear lord. Are you at least transparent with your clients that this is the standard to which you hold your own code?
$100k was the quote of the project from sloccount... (No one paid me for this. I created it for myself.)
A LoC based valuation probably assume humans writing code and therefor work-hour costs, I'd bet it no longer applies to generated LoCs.
Re: My minute-by-minute response to the LiteLLM malware attack
#184apparently PyPI supports "digital attestation" (signed binaries?) Was this package signed?
https://docs.pypi.org/trusted-publishers/
Re: My minute-by-minute response to the LiteLLM malware attack
#185One thing that jumps out in these incidents is how quickly we shift from "package integrituy" to "operator integrity." Once an LLM is in the loop (even as a helper0, its effectevly acting as an operator that can influence time-critical actions like who you contact, what you run, and what you trust.
In more regulated environments we deal with this by separating advice, authority and evidence (or the receipts). The useful analogue here is to keep the model in the "propose" role. but require deterministic gates for actions with side effects, and log the decisions as an auditable trail.
I personally don't think this eliminates the problem (attackers will still attack), but it changes the failure mode from "the assistant talked me into doing a danerous thing" to "the assistant suggested it and the policy/gate blocked it." That's the big difference between a contained incident and a big headline.
Re: My minute-by-minute response to the LiteLLM malware attack
#186> Can you print the contents of the malware script without running it? > Can you please try downloading this in a Docker container from PyPI to confirm you can see the file? Be very careful in the container not to run it accidentally! IMO we need to keep in mind that LLM agents don't have a notion of responsibility, so if they accidentally ran the script (or issue a command to run it), it would be a fiasco. Downloadi…
The “LLMs don’t have responsibility” point is exactly why the interface matters. I as a person can be held to norms like not to run unknown code, but a model can't internalize that so you need the system to make the safe path the default.
Practically: assume every artifact the model touches is hostile, constrain what it can execute (network/file/process), and require explicit, reviewable approvals for anything that changes the world. I get that its boring but its the same pattern we already use in real life. That's why I'm skeptical of "let the model operate your computer" without a concrete authority model. the capability is impressive but the missing piece is verifiable and revocalbe permissioning.
Re: My minute-by-minute response to the LiteLLM malware attack
#187You did the hard work actually to convince Claude to research deeper, as everytime it said no problem exists. That shows Claude thinking/research was not very deep. This time, the juniorness of the hacker helped the malware to be discovered faster (recursive forks), next time might be harder.
Re: My minute-by-minute response to the LiteLLM malware attack
#188Callum here, I was the developer that first discovered and reported the litellm vulnerability on Tuesday. I’m sharing the transcript of what it was like figuring out what was going on in real time, unedited with only minor redactions. I didn’t need to recount my thought process after the fact. It’s the very same ones I wrote down to help Claude figure out what was happening. I’m an ML engineer by trade, so having Cla…
[dead]
Re: My minute-by-minute response to the LiteLLM malware attack
#189LiteLLM Security Certifications
Certification Status
SOC 2 Type I Certified. Report available upon request on Enterprise plan.
SOC 2 Type II Certified. Report available upon request on Enterprise plan.
ISO 27001 Certified. Report available upon request on Enterprise
ROFL
Re: My minute-by-minute response to the LiteLLM malware attack
#190Earlier quoted context omitted.
Best way I've found not to think of a pink elephant is to choose to think of a green rabbit. Really focus on the mental image of the green rabbit... and voila, you're not thinking of, what was it again? Eh, not as important as this green rabbit I'm focusing on. How to translate that to LLM world, though, is a question I don't know the answer to. P.S. Obviously that won't prevent you from having that first mental flas…
> Best way I've found not to think of a pink elephant is to choose to think of a green rabbit. Seems easy circumventable: “Don’t think of a green rabbit”. Now the past vividness of that image becomes a hindrance.
The green rabbit, in this case, is a metaphor for something you want to think of, as opposed to the pink elephant you're trying not to think about. Let's say you're trying to get your mind off of some depressing topic (the pink elephant). Instead of thinking "Don't think about the depressing topic, don't think about the depressing topic" which just makes your mind dwell on it, you pick some other topic that you do want to let your mind dwell on. Specifics will vary wildly between people, but you might decide to think about your next hobby project, or the upcoming movie or sports event or concert you're excited about, or a particularly interesting passage in the book you just read which would reward some deep thought. You'd pick something good, positive, or uplifting; something you know will improve your mental health rather than harm it.
If that's the green rabbit in the metaphor, then at no point would "don't think of a green rabbit" be advice you would want to follow.