Top story
Stolen GitHub tokens enabled LiteLLM’s poisoned release
LiteLLM’s October 23 investigation traces the malicious 1.107.0 release to an agent-platform master key exposed on May 27 but left unrevoked. The Hacker News reports that Socket independently recovered credential-stealing workflows; LiteLLM says stolen maintainer identities let the attacker trigger and approve the October 21 release.
ThereforeThe malicious package could steal developers’ credentials when Python started, even without importing LiteLLM, according to Microsoft’s analysis quoted by The Hacker News.
LiteLLM’s investigation · The Hacker News investigationCopy link to: Stolen GitHub tokens enabled LiteLLM’s poisoned release
Also
Pennsylvania signs AI advertising disclosure law
Governor Josh Shapiro signed the Artificial Intelligence Deceptive Advertising Act on October 22; The Verge reports that it requires labels on deceptive synthetic ads, with exceptions including satire and evidently fictional content.
ThereforeAdvertisers outside Pennsylvania can fall within its scope when their ads reach the state.
palegis.us: Pennsylvania bill history · The Verge’s explanationCopy link to: Pennsylvania signs AI advertising disclosure law
Nvidia-backed neoclouds face falling shares and expensive credit
CNBC reports that CoreWeave, Nebius and IREN shares have fallen at least 30% this month, while yields on CoreWeave’s 2031 and 2032 bonds topped 15%.
ThereforeNvidia’s financing guarantees leave it exposed if backed customers default.
CNBC’s reportingCopy link to: Nvidia-backed neoclouds face falling shares and expensive credit
Research worth a look
Convovo finds opposing partisan preferences in forced-choice API tests
In October 21 tests with web search enabled, GPT-6.1 Sol favored Democrats and Grok 4.7 Republicans when pressed to recommend candidates; both consumer apps refused the same question.
Convovo’s study · TechCrunch’s interviews and additional testingCopy link to: Convovo finds opposing partisan preferences in forced-choice API tests
Tools & releases
Block announces Dessa
Block says its speech-to-speech model learned only from human conversation, listens while speaking and runs locally on a MacBook Pro M4 Max or better; early access is limited to a small group of safety researchers.
Block’s announcement · The Verge’s demonstration coverageCopy link to: Block announces Dessa