Six defense kits released for AI agents after Railway and LiteLLM supply-chain incidents
alvelda · x · 2026-10-23
Author alvelda released an Agent Cyber Defense Bundle of six kits responding to the Oct 21, 2026 Railway and LiteLLM security incidents.
- Secrets Exposure & Rotation Kit: a 30-minute first-response runbook (pause agents, rotate keys, revoke delegated OAuth grants, check misuse) plus rotationcheck.py that flags unrevoked or stale credentials
- AI Library Supply-Chain Defense Kit: pin-and-hash-lock policy for pip/npm/container images and an upgrade-quarantine routine, with a section on the poisoned litellm 1.107.0 release
- Inference Key Abuse & Spend Caps Kit: detects stolen AI provider keys running someone else's workload on your bill
- Also includes CI/Registry credential and OAuth revocation kits, tied together by a unified dashboard
A public MCP server and cyber advisory feed let agents keep their own defenses current.
Related event: Free Agent Cyber Defense bundle released after LiteLLM supply-chain attack(3 posts)→
More from coding & agent
- Letta launches FrontierMemory: benchmarking agent memory by downstream task gains, not recall — _AustinCalvert_ · 2026-10-23
- Drop a PowerShell Script in a Folder, Get a Live MCP Tool — dfinke · 2026-10-23
- Auth'd MCP servers can deliver user-personalized skills, an overlooked design win — dsp_ · 2026-10-23
- Bruin makes LLM inference a first-class primitive in data pipelines — pzakin · 2026-10-23
- Universe badge pairs RP2350 with an AGENTS.md so Copilot can code and deploy to it — mariorod1 · 2026-10-23
- Claude Code banked reset vanishes hours early, user demands Anthropic restore it — burny_tech · 2026-10-23