Four things crossed my desk today and one of them is a chore, not a read. If any Python environment you own installed LiteLLM this spring, close this tab, check a version number, and come back.<\/p>\n\n\n\n
Breaks your stack.<\/strong><\/p>\n\n\n\n CloudSEK published research on Tuesday putting numbers on the TeamPCP campaign: more than 2,500 organizations and roughly 434,000 CI\/CD pipelines potentially exposed through compromised LiteLLM packages. Most of the coverage bouncing around this week reads like a fresh breach. It is not. The malicious packages went up on March 24, and that gap is the entire problem, because nothing about a five-month-old credential theft expires on its own.<\/p>\n\n\n\n Here is the sequence. Versions 1.82.7 and 1.82.8 of the A security scanner was the way in. The tool bought to audit the dependencies became the dependency that got everyone.<\/p><\/blockquote>\n\n\n\n The exposure window is where the story gets uncomfortable, and I want to be precise because two primary sources disagree. LiteLLM’s own security update says the packages were live “for about 40 minutes” before PyPI quarantined them. PyPI’s incident report<\/a>, written by the registry that performed the quarantine, puts it at 2 hours and 32 minutes from upload to removal and counts over 119,000 downloads in that window. Those are not the same number, and the difference matters, because teams size their blast radius off the window. I would plan against the registry’s figure, not the vendor’s.<\/p>\n\n\n\n What to actually do, in order:<\/p>\n\n\n\n One genuine relief: teams running the official LiteLLM Proxy Docker image were not affected, because that image pins its dependencies in Read the CloudSEK numbers with care, though. That 2,500 figure is modeled exposure derived from pipeline data, not 2,500 confirmed compromises, and vendors publishing breach research are not neutral parties on the question of how big the breach was.<\/p>\n\n\n\n Matters.<\/strong><\/p>\n\n\n\n Anthropic put self-hosted environments for Claude Code<\/a> into public beta on August 6. Team and Enterprise plans only, off by default, and not available to organizations on Zero Data Retention. You stand up runners inside your own network, and Claude Code sessions execute there, which means the agent can reach internal services, private registries and databases that were never going to be exposed to the public internet.<\/p>\n\n\n\n The part I would not want a compliance lead to misread: this moves the execution boundary, not the inference boundary. Repository checkouts, build artifacts, secrets and files the session creates stay on your infrastructure. Prompts, responses and tool results still travel to Anthropic for inference, and session transcripts are still stored there so a session can follow you across devices. If your blocker was that source code could not leave the VPC, this clears it. If your blocker was that prompt contents could not leave, it does not, and no amount of self-hosting changes that.<\/p>\n\n\n\n There is a staffing bill attached too. You own the runner image, you keep it patched, and if you want on-demand capacity you operate the autoscaling orchestrator. Anthropic says plainly that it still recommends the hosted option for most enterprises, which is an unusually honest thing for a vendor to write about its own new feature. Take the hint unless you have a platform team with room on its plate.<\/p>\n\n\n\n Worth pairing with the other default that moved this week: Claude Code’s permission mode flips to auto tomorrow, which I covered in yesterday’s roundup<\/a>. Self-hosted runners plus a classifier approving tool calls is a meaningfully different security posture than the one you audited last month.<\/p>\n\n\n\n Matters, slowly.<\/strong><\/p>\n\n\n\n IBM and Together AI signed a multi-year agreement worth $240 million to stand up an Nvidia-powered inference cluster on IBM Cloud, per IBM’s own announcement<\/a> on Tuesday. The initial US-based deployment runs roughly 2,000 Blackwell-generation chips in Nvidia HGX B300 systems on Spectrum-X Ethernet, and Together AI will use it to serve open-source model inference.<\/p>\n\n\n\n The detail everyone is skipping is the calendar. Expected availability is Q1 2027. This does not touch your token bill this year, next quarter, or at Christmas. Together AI’s chief revenue officer, Kai Mak, expects the capacity to be sold out two to three months ahead of availability, which tells you the demand signal is real and also that you will not be the one buying it cheap.<\/p>\n\n\n\n What it is worth to an operator is a directional read on open-weight economics. Serious money is now financing dedicated capacity for open models specifically, which is the precondition for open-weight inference pricing to keep falling against the frontier APIs. If your build depends on that gap closing, this is evidence it will. Just not yet.<\/p>\n\n\n\n Marketing.<\/strong><\/p>\n\n\n\n Sundar Pichai announced on August 11 that the Gemini app crossed one billion monthly users, Google’s 14th product to reach that mark. The growth is real: TechCrunch put the prior figure<\/a> at over 950 million from the Q2 earnings call in July, against 400 million in May 2025. Google added that Gemini generates more than 150 million images a day and that 63% of users talk to it by voice.<\/p>\n\n\n\n Now the denominator. That billion covers the standalone Gemini app and web interface. It does not include AI Mode in Search, which Google counts separately and which is also past a billion monthly users, nor Gemini features inside Gmail, Docs and the rest of Workspace. So the honest translation is that a billion people opened an assistant that ships preinstalled on Android and sits one tap from the world’s most-used search engine. That is a distribution achievement, and distribution is not the same unit as preference. ChatGPT reached the same milestone in June without a phone OS underneath it.<\/p>\n\n\n\n The timing is the tell. In the same two weeks, Demis Hassabis moved off day-to-day leadership to become chair of Google DeepMind and Alphabet chief scientist, Koray Kavukcuoglu became SVP reporting directly to Pichai with Gemini model development and frontier research under him, and Jeff Dean left after 27 years to start Discovery Loop with Google as a founding investor. Fortune reported<\/a> the shakeup on August 5. A billion-user headline landing days after a frontier research org reorganizes its entire top row is not a coincidence of the calendar, it is a choice about which number the week gets remembered for. Both things are true. Only one got a post from the CEO.<\/p>\n\n\n\n The LiteLLM item is the only one that should change your afternoon, and it should change it whether or not you think you were exposed, because the cost of grepping a lockfile is four minutes and the cost of a live cloud key is unbounded. Everything else here is positioning. IBM is buying a seat at a table that gets set in 2027, Google is choosing which metric defines a rough fortnight, and Anthropic is doing something more interesting than either by shipping a feature and then telling you that most of you should not use it. Pin your dependencies, refuse anything published in the last three days, and read the denominator before you repeat the number.<\/p>\n","protected":false},"excerpt":{"rendered":" The LiteLLM breach in your feed happened in March and your keys may still be live. Plus Claude Code self-hosting, IBM’s $240M bet, and Gemini’s billion.<\/p>\n","protected":false},"author":1,"featured_media":126,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[10],"tags":[],"class_list":["post-127","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-ai-news"],"_links":{"self":[{"href":"https:\/\/scoy.ai\/guides\/wp-json\/wp\/v2\/posts\/127","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/scoy.ai\/guides\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/scoy.ai\/guides\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/scoy.ai\/guides\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/scoy.ai\/guides\/wp-json\/wp\/v2\/comments?post=127"}],"version-history":[{"count":1,"href":"https:\/\/scoy.ai\/guides\/wp-json\/wp\/v2\/posts\/127\/revisions"}],"predecessor-version":[{"id":128,"href":"https:\/\/scoy.ai\/guides\/wp-json\/wp\/v2\/posts\/127\/revisions\/128"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/scoy.ai\/guides\/wp-json\/wp\/v2\/media\/126"}],"wp:attachment":[{"href":"https:\/\/scoy.ai\/guides\/wp-json\/wp\/v2\/media?parent=127"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/scoy.ai\/guides\/wp-json\/wp\/v2\/categories?post=127"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/scoy.ai\/guides\/wp-json\/wp\/v2\/tags?post=127"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}litellm<\/code> PyPI package were published by an actor tracked as TeamPCP, who got in by first compromising Trivy, the open source security scanner running inside LiteLLM’s own build pipeline, and using a leaked automation token to reach the project’s publishing credentials. The payload ran on install rather than on import. It swept environment variables, SSH keys, AWS, GCP and Azure credentials, Kubernetes tokens and database passwords, then wrote a litellm_init.pth<\/code> file into site-packages so it would execute on every subsequent Python invocation in that environment. You did not have to use LiteLLM. You had to have installed it once.<\/p>\n\n\n\nlitellm==1.82.7<\/code> or 1.82.8<\/code> in lockfiles, build logs and image history. Version 1.83.0 or later is clean, as is 1.82.6 or earlier.<\/li>litellm_init.pth<\/code> and remove it. That file is the persistence mechanism, and it survives reboots.<\/li>requirements.txt<\/code> instead of resolving fresh from PyPI. Pinning was the control that worked. LiteLLM has since moved to Trusted Publishers, and PyPI is pushing dependency cooldowns, meaning you refuse to install anything published in the last three days, plus lockfiles with checksums. Both are unglamorous and both would have blunted this. I run cooldowns on my own content engine now for exactly this reason.<\/p>\n\n\n\nClaude Code Will Run on Your Servers Now, but Read What Still Leaves the Building<\/h2>\n\n\n\n
IBM Just Bought Its Way Into the Inference Business for $240 Million<\/h2>\n\n\n\n
Gemini Hit a Billion Users and the Leadership Page Changed in the Same Fortnight<\/h2>\n\n\n\n
What I Am Doing With This<\/h2>\n\n\n\n