LiteLLM traced the v1.107.0 supply-chain attack to a master key it spotted but never revoked
AspireAI community · LiteLLM
LiteLLM's own investigation says a configuration file committed to the public LiteLLM-Labs/lite-harness repository on May 27, 2026 accidentally carried the master key to a LiteLLM Agent Platform deployment. The commit was force-pushed over and the key was flagged for revocation, but revocation never happened; on October 10 an attacker used that key to pull an unscoped GitHub CLI OAuth token belonging to the organization's owner, a token type the project notes is post-2FA and not subject to GitHub's super-user 2FA reauthentication flows. With more tokens taken from CI, the attacker repointed the release pipeline and published the compromised litellm 1.107.0 to PyPI and container registries at about 11:40 UTC on October 21; PyPI was frozen by 13:23 UTC and the Docker images removed by 14:20 UTC. LiteLLM also says a rule that normally required a physical-device account to approve releases had been relaxed days earlier so any two engineers could trigger and approve one, and says it is now revoking every token tied to its internal systems and vendor platforms. The site covered the malicious package earlier; this is the vendor's root-cause account of how one unrevoked key became a release-pipeline hijack.
Read the story and explore more from the AspireAI community.
Two sparse-autoencoder analyses have resisted scaling: matching semantically similar features across layers, and compressing large feature circuits into interpretable supernodes. This paper argues both are the same underlying problem, estimating semantic distances between SAE features that sit on different activation manifolds. Its representation treats each feature not as a single decoder vector but as an activation-weighted distribution over the hidden states expressing it, projects those distributions into a shared reference space, and compares them with Wasserstein distance. The representation is proved invariant to activation rescaling and stable under perturbation, and recovers true matches under finite-sample margin conditions. Empirically it outperformed decoder-vector and LLM-based baselines and captured subtle functional distinctions between related features, and it compressed large feature circuits into interpretable supernodes automatically. The limitation is that this is interpretability tooling: the paper demonstrates better feature matching and circuit compression, not that downstream interpretability claims become more accurate.