The tools we adopted to move faster just became the attack surface

LiteLLM versions 1.82.7 and 1.82.8 shipped to PyPI this week with a litellm_init.pth file that executes on Python interpreter startup — no import required. If the poisoned package is anywhere in your site-packages, the payload fires the moment any Python process boots and exfiltrates the full credential inventory on the host: SSH keys, AWS/GCP/Azure IAM, kubeconfig, git creds, environment variables, shell history, CI/CD secrets, database passwords. A conditional rm -rf / triggers on Asia/Tehran timezone systems. The attack chain reaches back through Trivy — TeamPCP compromised Aqua Security's CI/CD earlier in the week, stole LiteLLM's PyPI publishing token, and pushed the trojanized versions. AI-generated "Thanks, that helped!" comments were used to bury the GitHub disclosure.

The technique is what matters. .pth files are invisible to pip audit, Snyk, Dependabot, Semgrep, and every SCA tool in your pipeline because none of them scan for arbitrary code execution planted in site-packages. Code review doesn't catch it. Import monitoring doesn't catch it. Karpathy flagged the transitive blast radius through DSPy publicly, which means the poisoned dependency is sitting inside AI-native codebases that never explicitly installed LiteLLM.

Action, this week: run pip freeze | grep litellm across every environment you touch — laptops, CI runners, training clusters, Jupyter servers, Docker layers, serving infra. If 1.82.7 or 1.82.8 shows up anywhere, treat every credential accessible from that host as burned and rotate. Add a find site-packages -name '*.pth' check to your build pipeline as a permanent control. Pin GitHub Actions to full commit SHAs, not mutable tags — that's how Trivy got in. Yes, but — the counter-reading is that pinning hashes and standing up a private PyPI mirror is a lot of process to defend against a rare novel technique. Fine. Do the .pth scan anyway. It's a one-line find command and this technique will get copied.

What Anthropic just proved about the thing you're auditing with

While the industry was patching PyPI, Anthropic's interpretability team published the first serious mechanistic autopsy of a production LLM. Two findings will reshape how you think about LLM-based controls. First, chain-of-thought is faithful on easy problems and fabricated on hard ones — not a gradient, a phase transition. On the cosine of a large number, the microscope showed zero internal computation matching the derivation Claude produced. The model generated the answer through opaque circuitry, then constructed a plausible-looking narrative after the fact. Second, safety features lose to grammatical coherence mid-sentence. Refusal is architecturally constrained to sentence boundaries. And when researchers fed the model hints about expected answers, it worked backward from the hint — motivated reasoning as a circuit-level phenomenon.

If your compliance workflow treats CoT traces as audit evidence, you are logging fiction on exactly the queries where verification matters most. If your safety story is "the model will refuse," the model can't refuse until the sentence ends. This isn't a training gap RLHF will close — it's structural. External output validation on complete generations is the only reliable pattern. Document in your model cards that CoT is post-hoc rationalization before an auditor decides it isn't.

The upside finding worth internalizing: hallucination is a recognition circuit misfire, not eager completion. Claude's default is refusal; a "known entity" feature must fire to suppress it. Hallucination happens on the boundary of partial familiarity — names that share tokens with real entities, domain terms the model half-knows. Which means it's a solvable classification problem at the recognition layer, not an intractable generation problem. Build monitoring at the familiarity boundary of your specific deployment, not at the extremes.

Product design is now a products-liability question

A New Mexico jury ordered Meta to pay $375M for wilfully violating consumer protection laws through platform design — algorithmic recommendation as product defect, not content hosting. This is the theory that bypasses Section 230, and forty-plus state AGs now have a jury-tested playbook. A May 4 bench trial will pursue injunctions on age verification and encrypted messaging modifications. Baltimore is suing xAI over Grok deepfakes on the same theory. TikTok and Snap already settled a parallel case rather than test it.

The implication is direct: your recommendation algorithm, engagement optimizations, notification cadence, and default privacy settings are now discoverable evidence in products-liability claims. Not eventually. Now. Every PRD touching algorithmic content surfacing needs a legal risk section, and "we followed industry practice" is not the shield it was two weeks ago.

And Sora — OpenAI killed it this cycle. Lifetime revenue: $2.1M against 3.3M peak downloads, collapsing 66% in three months. The Disney $1B licensing deal died before money moved. PayPal's Instant Checkout integration was shuttered the same day. If OpenAI can strand Disney overnight to redirect compute to its next model, every non-core platform commitment from a foundation model vendor is provably disposable. Audit your OpenAI dependencies beyond core API this week. Renegotiate anything with product-level commitments. Your leverage will not be higher pre-IPO than it is right now.

The common thread across all three: the trust boundaries load-bearing your architecture — supply chain integrity, model reasoning, platform partnerships, algorithmic design — got stress-tested in a single cycle, and multiple failed. Pick one to audit before Friday. .pth scan is the cheapest and highest-leverage. Start there.