Agent news
NEWS
Coverage of AI agent launches, model releases, pricing, and security, with links to related software and agent profiles.
Railway Says About 100,000 Workspaces Had Environment Variables Exposed
The company's preliminary report dates the campaign to October 20, describes encrypted secrets later decrypted through CI credentials, and still will not name the exploit.
LiteLLM's Poisoned 1.107.0 Release Started With GitHub Tokens in Its Own Gateway Logs
Malicious LiteLLM wheels and Docker images were live for about two hours on October 21. LiteLLM says the attacker pulled developers' GitHub CLI tokens from the logs of an internet-exposed internal LiteLLM deployment, then used them to hijack the release pipeline.
Railway Says Customer Secrets May Have Been Decrypted. Customers Saw Abuse Hours Before the Warning.
The hosting platform told users to rotate every environment variable at 5:51 PM ET. Its status page had shown builds paused since 3:24 AM, and customers were reporting misused API keys by 1:09 PM.