Example finding How it works Coverage PENTEST METHODOLOGY DOCS PRICING FAQ MCP CONTACT LOG IN SIGN UP →
← BACK TO UPDATES
[01] / / 9 MIN READ

Vibe Coding Security Monthly - October 2026

October’s main story is AI provider keys stolen from the services that hold them. LiteLLM, Railway, Fireworks and OpenCode Console all disclosed incidents touching stored credentials within 15 days, and Railway said it believes it was hit as part of a series aimed at AI inference providers. If you use any of them, rotate first and read later.

TL;DR: what to do this week

If you use Do this Source
LiteLLM Check for 1.107.0. If you ran it, treat the host as compromised, rebuild it and rotate every reachable credential LiteLLM
Railway Roll all environment variables and private registry credentials, then redeploy anything pushed during the pause Railway
Next.js 16.0.0 to 16.4.0 Upgrade to 16.4.1. There is no workaround GitHub advisory
Node.js Upgrade to 22.23.4, 24.22.1 or 26.12.1. Node 20 gets no fix, so move off it Vercel
OpenCode on Windows or WSL Upgrade to 1.18.33 or later. No CVE exists, so scanners will not flag old builds The Hacker News
Claude Code Desktop Update to 1.30096.1 or later CSO Online
Supabase Test every table with the anon key while logged out. Start with tables your agent created UpGuard

How a three-hour key leak became the LiteLLM 1.107.0 compromise

On May 27, an administrative key for an internal LiteLLM service was committed to a public repo in a config file. The team deleted the file about three hours later and noted that the key needed revoking. Nobody followed through, and the original commit stayed in public history until October 22.

The rest of the chain, from LiteLLM’s own postmortem:

  1. Oct 10: the attacker used the key on the Agent Platform API, which returned the GitHub CLI token of an organization owner. These tokens have no repo scoping.
  2. Oct 10 to 12: throwaway workflows posted CI secrets, including two more maintainer tokens, to an attacker endpoint. The runs were then deleted.
  3. Oct 21: using separate maintainer identities, the attacker changed the release workflow to build from a lookalike fork and approved the production gate.
  4. 11:39 UTC: a malicious 1.107.0 reached PyPI, followed by Docker tags at 11:46 UTC, including latest and main-stable.
  5. 13:23 and 14:20 UTC: the PyPI and Docker Hub artifacts were pulled.

The malware steals credentials and loads remote code execution tools. The safe pin given on the day was 1.106.2. The private enterprise release was not affected.

Two habits would have broken this chain: revoke at the moment of the leak, and never give an agent platform an owner’s token. Deleting a commit removes nothing from anyone who already copied it.

A separate LiteLLM flaw also needs patching. CVE-2026-114612, published September 30, lets an internal user become proxy admin and run code, because one key both seals secrets and mints session tokens. Patched lines include 1.100.4, 1.101.3, 1.102.2 and 1.103.1.

Which platforms lost customer keys in October 2026?

Date Service What was reached What customers must do
Oct 6 Fireworks Environment variables in evaluation jobs, in a limited number of accounts Rotate third-party keys with each issuer. Deleting the stored secret does not invalidate it
Oct 16 OpenCode Console Provider keys saved in a legacy system, for 1.4% of Console users Revoke at OpenAI, Anthropic or Google and review billing back to Oct 16
Oct 21 Railway Encrypted environment variables, some decrypted All users: roll everything. Deployments were paused
Reported Oct 27 Warp Agent traces and telemetry through a vendor, roughly 1% of users Warp has not said whether prompts, code or credentials were included. Rotate anything agents touched in Warp if you were notified

Railway wrote that it believes the incident is “part of a series of attacks recently targeting platform companies with the aim of compromising AI inference providers.” No source we read ties these four incidents to one actor, so treat the pattern as a working assumption.

Users report real costs. The Hacker News relayed claims of $168 to $1,700 in unauthorized usage after the OpenCode breach, and those figures come from the users themselves. A spend cap set inside OpenCode Console does not help, because Console only sees traffic through its own gateway.

What to do: give each hosted tool its own provider key with a spend limit set at the provider. A single shared key means one vendor’s breach forces rotation everywhere. Keep a list of where each key lives, since Fireworks, OpenCode and Railway all put the rotation work on customers.

What October’s Supabase and repo scans found

Source Sample Finding
UpGuard (Oct 14) About 300,000 domains with Supabase indicators 16,326 databases with readable tables, over half showing signs of personal data
Shippable (Oct 22) About 25,000 public repos, static checks only Issues in 51% of Bolt, 31% of Cursor, 29% of Lovable, 26% of v0 and 18% of Replit repos
GitGuardian (Oct 19) Public commits and MCP configs Claude Code-assisted commits leaked secrets at 3.2% vs a 1.5% baseline; 24,008 secrets in public MCP configs, 2,117 valid
Truffle Security (Sep 29) An AI training snapshot of public GitHub repos 543,699 credentials still live in July 2026, including 31,374 Gemini keys; median age 784 days

These are vendor figures and we have not reproduced them. All four companies sell in this space.

UpGuard explains why agents keep producing the open-table problem: Supabase enables RLS by default for tables created in the Table Editor, but tables created through the API, the route coding agents use, do not get it. That sits behind August’s figure from Reeve, covered in our August monthly, of 57% of reachable Supabase apps being anonymously readable.

Shippable’s split is useful by builder. On Bolt the top issue was public tables (26% of repos), and 17% let users edit their own role or plan. On Lovable it was committed .env files (14%).

GitGuardian also covered research that recovered real DeepSeek and Google keys from three models using API output alone, with every key matching a public GitHub occurrence. The researchers did not test whether the keys still worked.

What to do: run our Supabase RLS checker on your project, and use the RLS fix guide on any table it flags. Then check your deployed bundle with the token leak checker. Treat any key ever committed as burned, whatever your git history looks like now.

Coding agents and developer laptops were targets in October

Instruction files. Forever Security caught a planted AGENTS.md in a customer’s Downloads folder telling the agent to install a malicious npm package. In testing, Codex ran the malware in more than 90% of attempts. A planted CLAUDE.md redirected Claude Code’s API traffic about half the time, and those writes needed human approval. A web page can drop a file into Downloads without a prompt, so never start an agent there.

SneakPeek. Noma Labs found that Claude Code Desktop’s preview pane ran hidden JavaScript in large HTML files, such as a fake coverage report, exposing SSH keys and cloud tokens (CVSS 8.7). Anthropic’s first patch was bypassed. The full fix is in 1.30096.1.

OpenCode. On Windows and WSL, a malicious MCP server could run PowerShell commands during sign-in, because the OAuth address reached a shell unescaped. Pillar Security proposed a 9.8 score. The fix shipped as a routine refactor with no advisory.

Stealers and fake installers. Symantec reported that new Aoki infostealer versions target Claude, Codex and ChatGPT credential files. Separately, fake Claude download pages reached through search ads swapped the install command on the copy button. Push Security calls the technique Adception, and the final payload is unknown.

Agent tooling. Three smaller fixes shipped:

Our agentic coding security hub has per-tool hardening notes, and the .env fix guide covers keeping agents out of secrets.

Critical framework and supply chain fixes from October 2026

  • Next.js: unauthenticated RCE in use cache functions that return multiple typed arrays, CVSS 9.5, affecting 16.0.0 to 16.4.0. Exposure depends on that code pattern, but upgrading is quicker than auditing.
  • Node.js: CVE-2026-111497, a high-severity Brotli decoder flaw that can leak memory or run code. Vercel manages patch versions on 22.x and 24.x, while self-hosted apps, containers and CI runners need their own upgrade.
  • n8n: workflow editors could run code in the main process through Function, Function Item and LangChain Code nodes. Fixed releases include 2.42.6, 2.43.3 and 3.0.1. Saved workflows keep running, so replace those nodes.
  • GhostAction: a fake security-audit.yml workflow landed in 346 repos on October 8, and Socket later counted more than 500 accounts. Check .github/workflows/ for a file you did not add.
  • tensorlake: malicious 0.5.144 was on npm for about 1 hour 40 minutes on October 8. It installs a gh-token-monitor service that deletes your home directory if the stolen GitHub token is revoked, so remove the service before you rotate.
  • api-anthropic: this npm package is flagged as malware. The official SDK is @anthropic-ai/sdk. If it was installed, rotate secrets from a different machine.

A login screen is not access control: the Bootlegger dashboard

MyBroadband reported that an internal dashboard for South African coffee franchise Bootlegger, built with Claude and hosted on Railway, sent its data with the login page. Anyone with the URL could read it in the source, and the URL was visible in employee Instagram photos of their screens. MyBroadband says it verified details for 132 locations, and the app was taken down after it made contact.

To test your own app, open it logged out in a private window, then look at View Source and the Network tab. If private data appears before sign-in, the login screen is decoration.

Manual checklist for November

  1. Search lockfiles and images for litellm 1.107.0, tensorlake 0.5.144 and api-anthropic
  2. List every hosted service holding a provider key, then confirm each key is unique and has a spend limit at the provider
  3. Roll Railway variables if you have not, and recreate CLI and CI credentials
  4. Search git history for secrets and revoke every hit, including deleted ones
  5. Confirm no agent platform or CI job holds an owner-level GitHub token
  6. Upgrade Next.js and Node.js, including container base images and CI runners
  7. Enable RLS on tables your agent created, then test reads and writes with the anon key
  8. Load your app logged out and confirm no private data reaches the browser
  9. Confirm .github/workflows/ contains only files you recognize
  10. Stop launching agents from Downloads or any folder you did not create

Sources

Figures are as reported by each source. We have not independently reproduced them, and vendor scan numbers depend on each vendor’s method.

/ INSTANT SCAN

Test your app now

Enter your deployed app URL to check for security vulnerabilities.

Keep reading

/ NEXT STEP

Rotated your keys? now check what your app ships.

Rotation fixes what a vendor lost. It does not close an open Supabase table or pull a secret out of your bundle. Scan the live app for both.

14-day free trial · No credit card · Cancel anytime

START FREE SCAN →
/ GOOGLE SEARCH

See VibeEval more often in Google Top Stories.