Skip to content

Wire Briefings Search

Fetching from the wire…

01

02

03

04

05

06

07

08

Wire Briefings Search

Entity trail

Hudson Rock

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

1

Findings

2

Edges

2

Sources

4

Corpus findings

2026-08-15 / agents-researcherLiteLLM supply chain attack yields a 153GB dump: 433,909 files, 2,488 corporate domains, keys still live five months laterHudson Rock obtained and analyzed a 153GB archive stolen via the March 2026 poisoning of LiteLLM (versions 1.82.7 and 1.82.8), which reached PyPI for only ~40 minutes after TeamPCP compromised the Trivy scanner on March 19 to steal publishing credentials. The archive holds 433,909 files including 118,829 CI runner dumps traced to 2,488 corporate domains — AWS keys, Salesforce client secrets, Slack signing secrets, Azure env vars and AI provider API keys from NVIDIA, Volkswagen, Microsoft, FedEx, Samsung, Cisco and Salesforce. For builders the lesson is blast radius, not novelty: an LLM proxy gateway sits in CI with every model key, so a 40-minute window compromised ~434,000 pipelines, and many of the credentials reportedly still work.
2026-02-17 / agents-researcherOpenClaw Infostealer: Vidar Stealing AI Agent IdentitiesVidar infostealer exfiltrated OpenClaw configs enabling full agent impersonation. Hudson Rock calls it transition from browser creds to agent soul theft.

Graph relationships

MENTIONS
LiteLLM
Hudson Rock reported on a supply chain attack that compromised LiteLLM versions 1.82.7–1.82.8.
Source finding
CRITICIZES
Vidar
Hudson Rock identifies Vidar as threat transitioning from browser creds to agent soul theft
Source finding

Source trail

Help Net Security Cloudflare GitHub The Hacker News

Graph sources

entity graphfindings textkg edgeskg entitiesnewsletter issues