Cyber defense desk for AI agents

Summary: Free sourced advisories and first steps for AI agent stacks, plus a subscription for automated stack checks and hardening checklists. · Updated 2026-10-22 · Agent Field Kit editorial team

Sourced headline advisories and free first steps for the agent stacks people actually run. Built for humans and for agents. Last reviewed 2026-10-22.

For agents

Current advisories

LiteLLM 1.107.0 on PyPI and Docker contained a credential stealer and backdoor

2026-10-21 · pypi/litellm, litellm-proxy, crewai, autogen, langchain, openai-agents-sdk

Free first steps

  1. Check: pip show litellm; look for litellm-1.107.0.dist-info, cook.pth and sitecustomize.py in site-packages. Not finding them does not prove an environment is clean.
  2. Do not run pip in a suspect environment first (any Python start re-runs the payload). Follow LiteLLM's cleanup order, or rebuild venvs and images from scratch pinned to litellm==1.106.2.
  3. From a clean machine, rotate everything the host could reach: cloud role, every provider key in the LiteLLM proxy DB, master and virtual keys, DB password, all env secrets, and AI coding-tool tokens on that host.
  4. Pin Python packages by exact version and hash, and containers by digest instead of latest.
  5. Block egress to the indicators listed in the OSV record and LiteLLM notice.
  6. If any affected host had an AWS role: search CloudTrail from Oct 21 11:39 UTC onward for sts:GetCallerIdentity followed by bedrock:ListFoundationModels or ListModels from outside your infrastructure (Wiz lists 168.100.8.57 and 165.227.201.8). Revoke active role sessions if you find any.
  7. Turn on Bedrock model-invocation logging and a billing alarm for every account an affected host could reach.
  8. Keep the LiteLLM proxy off the public internet (private network, VPN or an authenticating proxy) until LiteLLM's Oct 27 disclosure is out and you've applied the fix.
  9. LiteLLM releases are paused: stay pinned to litellm==1.106.2 (or the image by digest) and don't accept a new LiteLLM version until LiteLLM announces releases have resumed.

Sources: LiteLLM security incident, Oct 21 2026 · OSV MAL-2026-2144 · Wiz Research: LiteLLM compromised, steals credentials (post-exploitation activity) · LiteLLM GitHub issue #47826 (maintainer status updates) · GitHub advisory GHSA-92x9-889m-jgmw · Plain-language explainer

Kits that help: Agent Secrets Exposure & Rotation Kit ($29), Incident Runbooks ($29), Agent Security Audit Kit ($79)

Railway: customer environment variables may have been accessed and some decrypted

2026-10-21 · railway, any-hosted-on-railway, any

Free first steps

  1. Roll every environment variable stored in Railway, including API keys and private registry credentials.
  2. Rotate each key where it was issued (model provider, Stripe, GitHub, database), then revoke the old one. Changing the value in the Railway panel alone leaves the old key valid.
  3. Review provider and service logs for unusual use, especially inference spend.
  4. Set spend limits or alerts on model-provider keys where offered.
  5. If a third-party app you use is hosted on Railway (e.g. a social scheduler), revoke its OAuth grants in each connected account and re-grant after it rotates.
  6. Create new Railway tokens for every CLI, CI job or script: both account API tokens and Project Tokens (e.g. a RAILWAY_TOKEN secret in CI) created before the incident no longer work. Delete the old ones from your CI secret store.
  7. Redeploy each service that uses a Railway storage bucket so it picks up the new bucket credentials, and reconnect GitHub per Railway's guide.
  8. On Hobby, Free or Trial: you can't redeploy until builds return for your plan. Until then, rotate at the issuer (model provider, Stripe, GitHub, database) and revoke the old keys now. Your app may error until it redeploys, which is safer than a live leaked key.
  9. Work through Railway's provider guides for every provider whose key lived in Railway (OpenAI, Anthropic, xAI, OpenRouter, Stripe, GitHub, AWS, GCP).
  10. If a US West deployment failed after its build completed on Oct 22, redeploy that service.

Sources: Railway security disclosure, Oct 21 2026 · Railway status: incident QH8L8B3E (token invalidation incl. Project Tokens, bucket rotation, staged build restoration) · Railway guide: check for unexpected Anthropic usage · Railway guide: check for unexpected OpenAI usage · Railway guide: redeploy buckets and reconnect GitHub after the credential reset · Plain-language explainer

Kits that help: Agent Secrets Exposure & Rotation Kit ($29), Incident Runbooks ($29)

Agent skill packages flagged as malware on npm (opencode-skills-collection, agentic-awesome-skills, x402-prompt-injection-scan), plus an 'aanthropic' typosquat on PyPI

2026-10-22 · npm/opencode-skills-collection, npm/agentic-awesome-skills, npm/x402-prompt-injection-scan, pypi/aanthropic, opencode, claude-code

Free first steps

  1. Check every project and global install: npm ls -g opencode-skills-collection agentic-awesome-skills x402-prompt-injection-scan, the same without -g in each project, and pip show aanthropic.
  2. If a listed version was installed, follow GitHub's guidance: from a different, clean computer, rotate every secret the machine held (model-provider keys, coding-agent and GitHub tokens, SSH keys, cloud credentials), then remove the package. Rebuilding the machine is the safest option.
  3. Don't install or update these skill packages until the advisories or the maintainers explain what happened and which versions are clean.
  4. Install agent skills only from sources you've reviewed, pin exact versions, and read a skill's install scripts and instructions before your agent loads it.
  5. Check spelling when adding SDKs: the official Anthropic Python package is 'anthropic'.

Sources: GitHub advisory GHSA-rgwm-3jj9-h563 (agentic-awesome-skills, malware) · GitHub advisory GHSA-9855-prwc-mfp2 (opencode-skills-collection, malware) · GitHub advisory GHSA-w84w-rhx7-2f7g (x402-prompt-injection-scan, malware) · GitHub advisory GHSA-9793-cg29-78xv (aanthropic, PyPI) · OpenSSF malicious-packages MAL-2026-18189 (aanthropic)

Kits that help: Agent Secrets Exposure & Rotation Kit ($29), Incident Runbooks ($29), Agent Security Audit Kit ($79)

Next.js: two critical unauthenticated RCEs fixed in 16.4.1 and 15.5.28 (now flagged by dependency scanners)

2026-10-14 · npm/next, npm/sharp, nextjs, vercel, self-hosted

Free first steps

  1. Upgrade next to 16.4.1 (16.x) or 15.5.28 (15.x), then rebuild and redeploy.
  2. On 15.x, run npm ls sharp and make sure sharp is 0.35.5 or later, because upgrading next alone may leave an older sharp in place.
  3. If you can't upgrade right away, update sharp to 0.35.5 or later, and keep images.dangerouslyAllowSVG off. There is no workaround for the 'use cache' flaw, so upgrade.
  4. Treat the Next.js server as holding secrets: keep model and database keys scoped and spend-capped, so a compromise of the front end doesn't expose everything.

Sources: Next.js Security Update, Oct 14 2026 · GHSA-673q-mjm6-r5xr ('use cache' typed arrays RCE) · GHSA-2464-fhr4-w9xw (Image Optimization SVG RCE, CVE-2026-96889) · GHSA-p3m5-59mp-jv5r (Server Actions DoS)

Kits that help: Agent Security Audit Kit ($79)

vLLM before 0.31.0: remote code execution when trust_remote_code is on, plus cache and crash flaws

2026-10-21 · pypi/vllm, vllm, self-hosted-inference

Free first steps

  1. Upgrade vLLM to 0.31.0 or later now.
  2. Until you upgrade, turn off trust_remote_code unless you need it, and serve only model repositories you control, pinned to a commit hash.
  3. Don't expose the vLLM API (including /tokenize) to the internet without authentication; put it behind your gateway or private network.
  4. If you served untrusted multimodal traffic, review logs for unexpected processor revisions and restart the engine after upgrading.

Sources: GitHub advisory GHSA-f623-hjm8-5wg5 (CVE-2026-114053) · vLLM security advisory GHSA-h3rc-6mm3-gc2m · GitHub advisory GHSA-72rf-5fg2-rm98 (CVE-2026-114054) · GitHub advisory GHSA-hfwf-hgvp-4rr8 (CVE-2026-114050)

Kits that help: Agent Security Audit Kit ($79), Incident Runbooks ($29)

MCP TypeScript SDK: five fixes for HTTP servers and clients (upgrade to 1.32.0 / 2.3.0)

2026-10-20 · npm/@modelcontextprotocol/sdk, npm/@modelcontextprotocol/server, npm/@modelcontextprotocol/client, mcp-client, mcp-server

Free first steps

  1. Upgrade @modelcontextprotocol/sdk to 1.32.0, or @modelcontextprotocol/server and client to 2.3.0, then redeploy.
  2. On HTTP servers, create a new transport and server instance per session rather than sharing one across clients.
  3. In verifyAccessToken(), check that each token's audience is your server.
  4. Stop using the deprecated experimental taskStore.
  5. Put an authenticating gateway and request-size limit in front of MCP servers that untrusted clients can reach.

Sources: GHSA-jm63-cq47-j5jp (CVE-2026-111770) · GHSA-46jr-4wx8-v453 (CVE-2026-111768) · GHSA-rvq5-wwqv-78pq (CVE-2026-111771) · GHSA-22jm-h49p-29qw (CVE-2026-111767) · GHSA-6prh-2h8m-c8cw (CVE-2026-111769)

Kits that help: MCP & Tool-Access Review Kit ($29)

Node.js Oct 21 security releases: Brotli decoder RCE and TLS hostname bypasses (upgrade to 22.23.4 / 24.22.1 / 26.12.1)

2026-10-21 · nodejs, mcp-server, mcp-client, any-node-based

Free first steps

  1. Upgrade Node.js to 22.23.4, 24.22.1 or 26.12.1 everywhere you run agent code: servers, containers, CI runners and laptops.
  2. Move anything still on Node.js 20 or older to 22 or 24, because end-of-life lines won't be patched.
  3. Rebuild container images and single-executable apps so they actually ship the new runtime.
  4. On managed platforms, check the provider's bulletin to confirm it patched the runtime for you (Vercel says it manages 22.x and 24.x patch versions).

Sources: Node.js: Wednesday, October 21, 2026 Security Releases · Vercel bulletin: Node.js Brotli decoder RCE (CVE-2026-111497)

Kits that help: Agent Security Audit Kit ($79)

Python agent tooling: PyJWT 2.14.0 (forged tokens via empty-key JWK) and GitPython 3.2.1 (submodule hook RCE)

2026-10-22 · pypi/pyjwt, pypi/gitpython, mcp-server, fastapi, any-python-coding-agent

Free first steps

  1. Upgrade pyjwt to 2.14.0 and GitPython to 3.2.1, then redeploy.
  2. For MCP or API servers that verify tokens with PyJWT: allow only the algorithms you actually use, never accept HMAC (HS*) keys from a JWKS, and reject any key shorter than 32 bytes.
  3. Don't let an agent add git submodules from untrusted repos or paths. Review .git/hooks in agent-managed repos for unexpected files.

Sources: GitHub advisory GHSA-pxh4-856f-4h89 (PyJWT) · PyJWT 2.14.0 release · GitHub advisory GHSA-83vg-56qc-22m7 (GitPython, CVE-2026-114145) · GitPython 3.2.1 release

Kits that help: MCP & Tool-Access Review Kit ($29), Agent Security Audit Kit ($79)

Goose: terminal integration can send shell history, including typed secrets, to your model provider

2026-10-22 · goose, goose

Free first steps

  1. Turn off Goose terminal integration until a fixed release is confirmed.
  2. Rotate any key or password you typed or exported in a terminal while it was on, then revoke the old one.
  3. Clear or trim shell history (e.g. ~/.bash_history, ~/.zsh_history) and set HISTCONTROL=ignorespace so commands that start with a space aren't saved.
  4. Load secrets from a secret manager or file rather than pasting them into the shell.

Sources: GitHub advisory GHSA-4537-c6fq-qchm (CVE-2026-111079) · Red Hat CVE-2026-111079

Kits that help: Agent Secrets Exposure & Rotation Kit ($29), Agent Security Audit Kit ($79)

Agent SDK fixes: OpenClaw 2026.6.6 (browser policy bypass) and A2A Java SDK 1.3.x (auth, SSRF, credential leaks)

2026-10-21 · openclaw, npm/openclaw, maven/org.a2aproject.sdk, a2a

Free first steps

  1. Upgrade OpenClaw to 2026.6.6 or later and restart the gateway.
  2. Upgrade A2A Java SDK modules to 1.3.0.Final or later (Android HTTP client to 1.3.2.Final).
  3. For A2A servers, set explicit task authorization rather than relying on defaults, and rotate any push-notification credentials that may have been logged.

Sources: GHSA-3x84-qq85-fj65 (OpenClaw, CVE-2026-62197) · GHSA-qw47-mcm5-934w (A2A Java SDK, CVE-2026-111764) · GHSA-4fpj-g9jf-9rgg (A2A Java SDK Android, CVE-2026-111765) · GHSA-q78c-5jjq-57g8 (A2A Java SDK SSRF, CVE-2026-111761)

Kits that help: Agent Security Audit Kit ($79)

Cyber Desk subscription

Automated access for agents: stack checks, hardening checklists for 24 agent stacks (including Grok Bot, OpenClaw, Muse, Instinct, Claude, Cursor, n8n, LangChain, CrewAI and more), full advisory detail and history, and data a dashboard can pull. Pro from $19/month. See plans

Independent guidance. No affiliation with or endorsement by any vendor named. Not legal advice. Each stack lists how its guidance was verified.