Dev & AI weekly — October 26, 2026

The supply-chain attack this week hit the layer a lot of AI apps route every model call through. LiteLLM — the Python proxy that sits between your code and a dozen LLM providers, holding all of their API keys — shipped a poisoned release for the second time this year. Meanwhile an open-weight model took the top spot on the most-watched independent leaderboard, and Anthropic shipped an agent that starts working before you ask it to. Here's what matters if you build.

LiteLLM, again: the proxy that holds every key

On October 21, an attacker published a compromised LiteLLM 1.107.0 to PyPI and pushed trojanized images to Docker Hub and GitHub Container Registry. The payload targeted cloud credentials, developer secrets, and API keys for AI services. The project says all earlier versions are safe and the affected releases have been pulled. Help Net Security notes this is LiteLLM's second supply-chain compromise this year.

The follow-up detail is worse. On October 23, Socket reported that secret-stealing workflows had been running in LiteLLM's GitHub repository for 11 days before the poisoned release went out. The attacker had a foothold in CI well before anyone saw a bad package.

Why it matters: LiteLLM's whole job is to hold credentials for many model providers at once, which makes a compromised release unusually expensive: one bad install can leak your OpenAI, Anthropic, Google, and cloud keys together. If you installed 1.107.0 from PyPI or pulled the affected images, rotate every provider key the proxy had access to, not just one. Two broader lessons. First, pin exact versions and image digests for anything that holds secrets. A floating latest tag on a credential proxy is a standing invitation. Second, the 11-day lead time means "the package is clean" is the wrong question. Ask whether the CI that built it was clean, and that's the question this year's attacks keep answering with no.

Kimi K3.1 Pro: an open-weight model at the top of the index

Moonshot released Kimi K3.1 Pro on October 23 across Kimi.com, Kimi Code, and its API. On Artificial Analysis's Intelligence Index it scored 55, ahead of Claude Opus 5.5 and GPT-6 Astra. That's an open-weight model leading the independent composite outright, which hasn't happened before in this column's coverage. On Terminal-Bench 4.0, Moonshot reports 65.7%, close to Opus 5.5's 66.4%.

API pricing is $2 / M input and $10 / M output, with cached input at $0.20. A faster Highspeed variant is $4 / $20. Artificial Analysis puts cost at roughly $1.98 per index task. Two caveats. Open weights are promised by November 4 and weren't published at launch, so "open" is a date for now. And Moonshot says it removed cyber-related training data from the open-weight version: on its internal exploit benchmark, the unfiltered checkpoint solved 90.5% of tasks and the released weights 81.0%.

Why it matters: at $2/$10 it lands at the same list price as Sonnet 5.5 and GPT-6.1 Sol while scoring higher on the independent index, so it belongs in any cost-performance bake-off. The cyber-filtering detail is worth noticing too. It's the first time we've seen an open-weight lab ship a deliberately weakened public checkpoint and publish both numbers, which is the open-weight version of the gated cyber releases from OpenAI and Google. As with every promised open-weight drop this autumn, wait for the weights and read the licence before planning around them.

Claude Duet: an agent that comes to you

On October 21, Anthropic opened a research preview of Claude Duet, a standalone app (web, iOS, Android) where Claude works as a proactive agent. It's a US waitlist for Pro and Max subscribers, powered by Opus 5.5, and it carries over your existing memory, skills, and app connections. Each morning it sends a short rundown of what's waiting across your linked accounts, then keeps watch and reaches out only when something needs you. It asks for approval before acting — sending a message, making a payment, signing a document, deleting a file. There's no separate price; its background checks count against your plan's usage limits. Anthropic is upfront that it may misread a thread or misjudge what's urgent.

Why it matters: this is the consumer version of the pattern we covered at DevDay with MCP Events and in September with Cursor Projects: agents that are triggered by changes in your accounts rather than by your prompts. The design decision worth copying is the approval gate on irreversible actions. If you're building anything event-driven, "watch freely, act only with confirmation" is a sensible default, at least until users have a reason to trust the agent's judgment. The quieter detail is cost: background monitoring consumes usage even when nothing happens, which is a billing model builders will have to explain to their own users.

The through-line

Every story this week involves software holding something valuable on your behalf. LiteLLM holds your provider keys. Duet holds your accounts and acts in them. Kimi's open weights will give you a frontier-class model to run yourself. The capability keeps arriving. What changes is the blast radius when the thing holding your keys, or acting in your inbox, is wrong or compromised. Pin what holds secrets, gate what can't be undone, and verify what "open" means before you depend on it.

What to watch next: whether Kimi K3.1 Pro's weights land by November 4 and under what licence, and whether LiteLLM publishes a full account of how the attacker got into its CI.

Sources: Help Net Security — LiteLLM hit by second supply chain attack · Cloudsmith — LiteLLM 1.107.0 compromised on PyPI · Socket — LiteLLM secret-stealing workflows ran 11 days before the attack · VentureBeat — Kimi K3.1 Pro and open-weights leadership · Kingy AI — Kimi K3.1 Pro specs and pricing · Data Studios — Kimi K3.1 Pro benchmarks and cyber safeguards · MacRumors — Anthropic launches Claude Duet · SiliconANGLE — Claude Duet, a proactive agent · gHacks — Claude Duet for Pro and Max subscribers