{
  "type": "bundle",
  "id": "bundle--ebe96ff0-0102-4992-8151-4d99eecebb98",
  "objects": [
    {
      "type": "identity",
      "spec_version": "2.1",
      "id": "identity--b106305c-0100-414a-84ff-91eeab20701a",
      "created": "2026-10-21T00:00:00.000Z",
      "modified": "2026-10-21T00:00:00.000Z",
      "name": "Optimus Labs · Civilizations",
      "identity_class": "organization",
      "description": "Threat research team at Optimus Labs. Agentic AI attack surface research.",
      "contact_information": "https://optimuslabs.io/research/briefings"
    },
    {
      "type": "report",
      "spec_version": "2.1",
      "id": "report--1008e738-0101-4716-8109-502e110a9e4e",
      "created_by_ref": "identity--b106305c-0100-414a-84ff-91eeab20701a",
      "created": "2026-10-21T00:00:00.000Z",
      "modified": "2026-10-21T00:00:00.000Z",
      "name": "Four Custodians of AI Provider Keys, Hit in Sixteen Days",
      "description": "Fireworks, OpenCode, LiteLLM and Railway all hold customers' AI provider keys or environment variables, and each has now been breached or backdoored. Attribution is unconfirmed.\n\nLive incidents, as of Oct 21, 2026. On Oct 6, Fireworks found that someone had used internal credentials to read environment variables, including API keys, in a limited number of customer accounts. On Oct 17, OpenCode said a breach of its hosted Console may have exposed provider keys for 1.4% of Console users. On the morning of Oct 21, a poisoned LiteLLM release went out through PyPI and Docker with a credential stealer built to take the provider keys a proxy stores. The same day, Railway said someone may have read decrypted customer environment variables and paused all deployments. Railway also said it believes this is part of a series of attacks on platform companies, aimed at AI inference providers. No one has published a root cause that links all four.",
      "published": "2026-10-21T00:00:00.000Z",
      "report_types": [
        "threat-report"
      ],
      "confidence": 85,
      "labels": [
        "Credential",
        "Inference",
        "AI Asset Supply Chain Security",
        "Cyber Hygiene",
        "severity:critical"
      ],
      "object_refs": [
        "indicator--d13ae5a0-0108-4745-82fc-d6d1bd2435ce",
        "indicator--77a7bbb1-0102-4bfb-86a5-704a78aa87ac",
        "indicator--6a5a0f64-0103-445c-8b59-db386b5de3c0",
        "indicator--4c199828-0105-4216-8d1c-5a3e4d1f5a3e",
        "indicator--ddfa2058-0105-45b5-8230-0fa13deff460",
        "software--58392834-0102-4ddd-893b-95e9593be611",
        "software--9157ed70-0102-4c1e-86fa-a7e92925a598",
        "software--4e18a728-0102-48fa-8f1a-efd24f1af022",
        "software--a57096cc-0102-4fc6-85b8-d36f6a672f69",
        "software--f4d92c28-0102-4fdc-8a24-5c0cf5dbbc04",
        "software--051e80c8-0102-4549-841c-b5810620b611",
        "software--f0fbc6c7-0102-43b3-8e06-7a8cf1fe0a7a"
      ],
      "external_references": [
        {
          "source_name": "Optimus Labs · Civilizations",
          "url": "https://optimuslabs.io/research/briefings/ai-provider-key-custodians-breached-oct-2026"
        },
        {
          "source_name": "Railway security disclosure, Oct 21",
          "url": "https://blog.railway.com/p/security-disclosure-wednesday-october-21st"
        },
        {
          "source_name": "Railway incident status",
          "url": "https://status.railway.com/incident/QH8L8B3E"
        },
        {
          "source_name": "LiteLLM incident report, Oct 21",
          "url": "https://docs.litellm.ai/blog/security-incident-oct-21-2026"
        },
        {
          "source_name": "LiteLLM security issue #47826",
          "url": "https://github.com/BerriAI/litellm/issues/47826"
        },
        {
          "source_name": "The Hacker News: LiteLLM compromised",
          "url": "https://thehackernews.com/2026/10/litellm-compromised-in-supply-chain.html"
        },
        {
          "source_name": "The Register: LiteLLM supply chain attack",
          "url": "https://www.theregister.com/security/2026/10/21/litellm-supply-chain-attack-hoovers-up-passwords-and-secrets/5304548"
        },
        {
          "source_name": "JFrog: LiteLLM hijacked again",
          "url": "https://research.jfrog.com/post/litellm-hijacked-again/"
        },
        {
          "source_name": "Socket: LiteLLM compromise",
          "url": "https://socket.dev/blog/litellm-compromise"
        },
        {
          "source_name": "Wiz: LiteLLM compromised, steals credentials",
          "url": "https://www.wiz.io/blog/litellm-compromised-steals-credentials"
        },
        {
          "source_name": "Endor Labs: LiteLLM 1.107.0",
          "url": "https://www.endorlabs.com/learn/litellm-1-107-0-compromised-python-startup-hooks-steal-cloud-ai-and-proxy-credentials"
        },
        {
          "source_name": "Fireworks October 2026 security incident",
          "url": "https://fireworks.ai/security/bulletins/october-2026-security-incident"
        },
        {
          "source_name": "LAVA: Fireworks AI incident",
          "url": "https://lava.security/blog/fireworks-ai-security-incident"
        },
        {
          "source_name": "OpenCode statement on X, Oct 17",
          "url": "https://x.com/opencode/status/2111519637049319818"
        },
        {
          "source_name": "Optimus Labs briefing #13: OpenCode Console",
          "url": "https://optimuslabs.io/research/briefings/opencode-console-breach-provider-key-exposure"
        },
        {
          "source_name": "Optimus Labs briefing: Salesloft Drift OAuth supply chain",
          "url": "https://optimuslabs.io/research/briefings/salesloft-drift-oauth-supply-chain"
        },
        {
          "source_name": "Optimus Labs briefing: arrayref poisoned Rust crate",
          "url": "https://optimuslabs.io/research/briefings/arrayref-rust-crate-build-time-rce"
        },
        {
          "source_name": "Optimus Labs briefing: Coder registry hijack",
          "url": "https://optimuslabs.io/research/briefings/coder-registry-infrastructure-hijack"
        },
        {
          "source_name": "Cloud Security Alliance: TeamPCP and AI infrastructure",
          "url": "https://labs.cloudsecurityalliance.org/research/csa-research-note-teampcp-ai-infra-supply-chain-20260406-csa/"
        },
        {
          "source_name": "Ars Technica: terabytes of credentials leaked",
          "url": "https://arstechnica.com/security/2026/08/terabytes-of-credentials-leaked-in-massive-supply-chain-attack/"
        },
        {
          "source_name": "Anthropic threat report, Sep 2026",
          "url": "https://www.anthropic.com/threat-intelligence-report-september-2026"
        },
        {
          "source_name": "OWASP Top 10 for Agentic Applications 2026",
          "url": "https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/"
        },
        {
          "source_name": "OWASP Top 10 for LLM Applications 2026",
          "url": "https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/"
        }
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d13ae5a0-0108-4745-82fc-d6d1bd2435ce",
      "created_by_ref": "identity--b106305c-0100-414a-84ff-91eeab20701a",
      "created": "2026-10-21T00:00:00.000Z",
      "modified": "2026-10-21T00:00:00.000Z",
      "name": "sha256: 1bbcb1443bc962e45f5aad53fe3d2c30600e0379715fb6c664cdd3ac126c339e",
      "description": "Docker tags on Oct 21: v1.107.0, latest, main-latest, main-stable (digest sha256:1bbcb1443bc962e45f5aad53fe3d2c30600e0379715fb6c664cdd3ac126c339e)",
      "indicator_types": [
        "compromised",
        "malicious-activity"
      ],
      "pattern": "[file:hashes.'SHA-256' = '1bbcb1443bc962e45f5aad53fe3d2c30600e0379715fb6c664cdd3ac126c339e']",
      "pattern_type": "stix",
      "valid_from": "2026-10-21T00:00:00.000Z",
      "labels": [
        "ai-provider-key-custodians-breached-oct-2026",
        "credential",
        "inference"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--77a7bbb1-0102-4bfb-86a5-704a78aa87ac",
      "created_by_ref": "identity--b106305c-0100-414a-84ff-91eeab20701a",
      "created": "2026-10-21T00:00:00.000Z",
      "modified": "2026-10-21T00:00:00.000Z",
      "name": "file: cook.py",
      "description": "Files in site-packages: cook.pth, cook.py, sitecustomize.py",
      "indicator_types": [
        "compromised",
        "malicious-activity"
      ],
      "pattern": "[file:name = 'cook.py']",
      "pattern_type": "stix",
      "valid_from": "2026-10-21T00:00:00.000Z",
      "labels": [
        "ai-provider-key-custodians-breached-oct-2026",
        "credential",
        "inference"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--6a5a0f64-0103-445c-8b59-db386b5de3c0",
      "created_by_ref": "identity--b106305c-0100-414a-84ff-91eeab20701a",
      "created": "2026-10-21T00:00:00.000Z",
      "modified": "2026-10-21T00:00:00.000Z",
      "name": "file: sitecustomize.py",
      "description": "Files in site-packages: cook.pth, cook.py, sitecustomize.py",
      "indicator_types": [
        "compromised",
        "malicious-activity"
      ],
      "pattern": "[file:name = 'sitecustomize.py']",
      "pattern_type": "stix",
      "valid_from": "2026-10-21T00:00:00.000Z",
      "labels": [
        "ai-provider-key-custodians-breached-oct-2026",
        "credential",
        "inference"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4c199828-0105-4216-8d1c-5a3e4d1f5a3e",
      "created_by_ref": "identity--b106305c-0100-414a-84ff-91eeab20701a",
      "created": "2026-10-21T00:00:00.000Z",
      "modified": "2026-10-21T00:00:00.000Z",
      "name": "url: http://www.litellm.dev/healthcheck",
      "description": "Exfiltration: hxxp://www[.]litellm[.]dev/healthcheck. Dead drop: raw[.]githubusercontent[.]com/letters9813/pythonclient-test/main/domain.txt",
      "indicator_types": [
        "compromised",
        "malicious-activity"
      ],
      "pattern": "[url:value = 'http://www.litellm.dev/healthcheck']",
      "pattern_type": "stix",
      "valid_from": "2026-10-21T00:00:00.000Z",
      "labels": [
        "ai-provider-key-custodians-breached-oct-2026",
        "credential",
        "inference"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ddfa2058-0105-45b5-8230-0fa13deff460",
      "created_by_ref": "identity--b106305c-0100-414a-84ff-91eeab20701a",
      "created": "2026-10-21T00:00:00.000Z",
      "modified": "2026-10-21T00:00:00.000Z",
      "name": "domain: raw.githubusercontent.com",
      "description": "Exfiltration: hxxp://www[.]litellm[.]dev/healthcheck. Dead drop: raw[.]githubusercontent[.]com/letters9813/pythonclient-test/main/domain.txt",
      "indicator_types": [
        "compromised",
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'raw.githubusercontent.com']",
      "pattern_type": "stix",
      "valid_from": "2026-10-21T00:00:00.000Z",
      "labels": [
        "ai-provider-key-custodians-breached-oct-2026",
        "credential",
        "inference"
      ]
    },
    {
      "type": "software",
      "spec_version": "2.1",
      "id": "software--58392834-0102-4ddd-893b-95e9593be611",
      "name": "Fireworks AI"
    },
    {
      "type": "software",
      "spec_version": "2.1",
      "id": "software--9157ed70-0102-4c1e-86fa-a7e92925a598",
      "name": "OpenCode"
    },
    {
      "type": "software",
      "spec_version": "2.1",
      "id": "software--4e18a728-0102-48fa-8f1a-efd24f1af022",
      "name": "LiteLLM"
    },
    {
      "type": "software",
      "spec_version": "2.1",
      "id": "software--a57096cc-0102-4fc6-85b8-d36f6a672f69",
      "name": "Railway"
    },
    {
      "type": "software",
      "spec_version": "2.1",
      "id": "software--f4d92c28-0102-4fdc-8a24-5c0cf5dbbc04",
      "name": "Anthropic"
    },
    {
      "type": "software",
      "spec_version": "2.1",
      "id": "software--051e80c8-0102-4549-841c-b5810620b611",
      "name": "OpenAI"
    },
    {
      "type": "software",
      "spec_version": "2.1",
      "id": "software--f0fbc6c7-0102-43b3-8e06-7a8cf1fe0a7a",
      "name": "Google"
    }
  ]
}