> daily_signal(2026_10_27)
A key LiteLLM never revoked shipped malware to every machine that updated, Proton tied staff jobs to an AI interview, an AI DJ topped LA radio, and an AI caught what a hospital missed.
PickBits Daily Signal · Tuesday, October 27, 2026
// tl;dr
- LiteLLM exposed the master key to its own internal AI tooling in a May config-file commit, deleted the file, and never revoked the key. In October an attacker used it to seize a token controlling all of LiteLLM's GitHub repositories and pushed a tampered v1.107.0 to PyPI and Docker carrying a credential stealer plus a dormant command-and-control. The malware runs on every Python startup, even in projects that never import LiteLLM. The last safe release is v1.106.2; private enterprise-registry customers were not affected.
- Proton told staff on Monday it will "re-interview" people across the company about how they use AI in their work. A leaked internal email reported by 404 Media calls the interviews "consequential" and ties them to "continued employment." It is one of the starkest cases yet of AI fluency converting from a nice-to-have into a condition of keeping your job.
- Entravision's AI co-host "Coyotec" has become a genuine draw on LA's Jose 97.5 FM, voicing pro-immigrant commentary on immigration raids and elections. The ElevenLabs-based voice is modeled on a company executive and shares the mic with human DJ Geraldine "GeeGee" Guzman. The show's weekly audience among Hispanic men 25-54 rose 75% March to April; SAG-AFTRA warns stations against using AI hosts to dodge consent and pay as US radio jobs fell from about 85,000 in 2019 to 66,000 in 2025.
- Virginia's Sentara health system put Regard, an AI that reads charts inside the electronic health record, live across all 12 of its hospitals, part of more than 150 nationwide. It flags worsening problems like sepsis earlier and summarizes overnight changes; in one documented case it surfaced that a patient's hypothyroidism drug had been paused, which a physician confirmed was driving uncontrolled heart failure. The projected staff-hour savings are an unconfirmed pilot forecast.
The one with the clearest line back to what we've been tracking is LiteLLM. We've logged supply-chain compromises of the tools developers trust all year, the npm and TanStack poisonings and the Red Hat packages among them, and this one's the sharpest yet, because the breach came down to something dull: a key the company found, deleted, and left switched on for five months, until someone walked in and used it to push malware to everyone who ran one update.
The other three are AI crossing into a room it used to stay out of: your performance review, the voice on your morning drive, and the overnight read of your hospital chart. One of those is genuinely good news, the Sentara catch, and it's the one I'd read last so it stays with you. Telling the catch from the capture, every single day, is the whole job here.
LiteLLM deleted the file and left the key live for five months, Proton put its staff's jobs on an AI-use interview, and the voice winning LA's morning drive turned out to be a machine nobody has to label.
1. A master key LiteLLM leaked in May and never revoked let an attacker ship malware to everyone who updated.
It runs a credential stealer every time Python starts, even in projects that never touch LiteLLM.
LiteLLM is the plumbing between a lot of apps and the AI models they call, and it sits inside a very large number of Python projects. Back in May, its post-mortem says, LiteLLM accidentally committed a config file that contained the master key for its internal agent tooling. The company spotted the file and removed it. It never revoked the key. In October, an attacker used that still-live key to obtain a token controlling all of LiteLLM's GitHub repositories, then published a tampered release, v1.107.0, to both PyPI and Docker. All seven malicious wheels were live on PyPI roughly 11:39 to 13:23 UTC on October 21 before being pulled.
The payload is what makes this worse than a normal bad package. It bundled a credential stealer targeting browser, cloud, and AI secrets, plus a dormant command-and-control capability, and it was wired to run on every Python startup, not just when a program imports LiteLLM. The post-mortem and Ox Security describe three files dropped into the Python site-packages root, cook.pth, cook.py, and sitecustomize.py, which execute whenever any interpreter on the machine starts. The stealer went after browser logins, cloud keys, and AI keys alike. LiteLLM says private enterprise-registry customers weren't affected and names v1.106.2 as the last safe version.
Why this matters: If a machine where you work installed LiteLLM v1.107.0, treat it as compromised right now, not as a maybe, and rotate everything it could reach. It's the one that should change how you think about leaked secrets. The failure wasn't the exposure in May. It was the five months of treating "deleted the file" as if it meant "killed the key." A credential that sits in a public commit is burned the instant it lands, whether or not you later scrub the history, and a stealer that runs on every Python startup means the blast radius isn't your LiteLLM projects, it's every secret on the box.
Action this week: Pin LiteLLM to v1.106.2 or earlier in your lockfiles and your private registry, and audit any CI runner, container image, or dev box that pulled from public PyPI or Docker on October 21. Then grep your site-packages roots for cook.pth, cook.py, and sitecustomize.py, because those three files are the tell. The habit I'd set after this, having watched a near-identical package takeover earlier this year, is to split two steps your team probably treats as one: get someone to confirm in writing that when a leaked secret is "handled," it was actually revoked and rotated, not just pulled from the repo.
therecord.media: Popular AI tool LiteLLM says unrevoked key allowed hackers to target users (October 26, 2026)
wiz.io: LiteLLM compromised, malicious v1.107.0 steals browser, cloud and AI credentials; last safe release v1.106.2 (October 2026)
ox.security: LiteLLM 1.107.0 compromised with a RAT/infostealer dropped into site-packages (cook.pth, cook.py, sitecustomize.py) (October 2026)
2. Proton is making its whole staff re-interview for their own jobs over how they use AI.
A leaked internal email calls the interviews "consequential" and ties them to "continued employment."
The privacy-first software maker Proton told employees on Monday that it'll "re-interview" people across the company about how they use AI in their work. The detail comes from a leaked internal email obtained by 404 Media, which states plainly that the re-interviews are "consequential," and the reporting ties them to "continued employment." In plain terms, that's re-qualifying for the role you already hold, graded on how you use a specific class of tool.
The framing is what makes this land harder than a normal training push. A company known for taking a strong line on user privacy is now gating its own workers' jobs on whether they actually use AI, in interviews a one-line internal email calls high-stakes without publishing the criteria. And my read is that this pressure isn't unique to Proton: plenty of people are already being pushed to use AI faster than they can keep up, and the ones doing the work usually feel a lot more nervous about it than the ones mandating it. Proton has just put the quiet version in writing and attached a meeting to it.
Why this matters: If you work somewhere pushing AI hard, your use of it may be about to become a condition of keeping your job rather than a line on your review. My own read is that the danger here is the vagueness, not the ambition: an interview a company calls "consequential" without a written rubric is indistinguishable, from the employee's chair, from a quiet layoff with extra steps. We've tracked the AI-and-jobs arc all year, from the tech layoffs that cited AI to "redundancy washing," and this is the same force arriving as a named, scheduled event instead of a restructuring press release. The consent, consistency, and discrimination questions a surprise re-interview raises are exactly the ones a terse email leaves open.
Action this week: If you manage people, decide now, in writing, whether AI fluency is a development goal or a retention bar, and tell your team which, because they'll read a vague "re-interview" as the second one no matter what you intended. If you're the one being interviewed, document how you already use the approved tools and ask HR for the explicit, written criteria before you sit down. Every time I've watched one of these go sideways, it was the undefined version, where nobody could say afterward what "good" was supposed to look like.
PickBits Daily Signal is free, and the best way to support it is to forward it to one person who would read it. Subscribe today!
3. An AI DJ named Coyotec has become a genuine radio star on LA's Spanish-language airwaves.
It riffs on immigration raids and elections while human hosts warn it is coming for their jobs.
Coyotec is an AI co-host on Entravision's Jose 97.5 FM in Los Angeles, a synthetic voice built on ElevenLabs technology and modeled on the voice of Entravision Audio president Eduardo Maytorena. It shares the morning mic with human DJ Geraldine "GeeGee" Guzman, who feeds it topics it turns into its own on-air commentary, much of it taking pro-immigrant positions on immigration raids and elections. The audience is real: Entravision, citing Nielsen Audio, says the show's weekly audience among Hispanic men 25-54 jumped 75% from March to April 2026, against 4% for the total Hispanic market, and the company is expanding the format to additional US markets.
The people whose industry this is are the ones sounding the alarm. SAG-AFTRA is warning broadcasters not to use AI hosts to sidestep consent and compensation, in a business that's already shed roughly a fifth of its jobs, from about 85,000 US radio jobs in 2019 to 66,000 in 2025. And what Coyotec actually is matters: its "hot takes" are commentary generated from topics a human hands it, not a person's lived opinion, which is useful context for anyone taking its election or immigration commentary at face value.
Why this matters: The voice shaping opinion on immigration during an election year, on a station winning real listeners, may be a machine, and nothing today requires anyone to tell you which. We've followed the synthetic-voice thread as it went from a party trick to something real, the voice-cloning tools that need only minutes of sample audio and the SAG-AFTRA contract fight whose AI provisions were always going to travel outside Hollywood, and this is that fight landing on live airwaves aimed at a specific community. The hard part is that this isn't a scam: listeners like it, the ratings are up, and the economics plainly favor the station, which is exactly why "just disclose it" is doing more work than it sounds.
Action this week: Push for plain, on-air disclosure, every time, that a host is synthetic, and back the local stations and performers pressing for it, because the window to set that norm is open only while audiences can still tell the difference. If you work in radio or media, track how the AI-host economics are being pitched to stations, since "ratings went up" is the number that'll be used to skip the consent and pay guardrails the union is asking for. And if you're an advertiser or a regulator near election or immigration coverage, ask for the disclosure standard now, while it's cheap to require.
wired.com: This AI radio host speaks Spanish and backs immigrants, and it is winning over listeners (October 26, 2026)
insideradio.com: Entravision LA reports strong ratings gains for AI-driven morning show (October 2026)
aiweekly.co: Entravision's AI DJ Coyotec expands to additional US markets across Spanish-language radio (October 2026)
4. All 12 Sentara hospitals switched on an AI that reads your chart overnight and flags what clinicians miss.
In one documented case it caught a paused thyroid drug that was driving a patient's heart failure.
Virginia's Sentara health system has put Regard, an AI that reads admission charts, monitoring notes, and medical histories inside the electronic health record, live across all 12 of its hospitals, part of more than 150 hospitals nationwide now using it. It surfaces new or worsening problems, like sepsis, earlier than a busy team might, and gives case managers a daily summary of what changed overnight. Regard co-founder and president Nate Wilson says catching problems like sepsis earlier is associated with shorter hospital stays, and Sentara's chief health information officer, Dr. Rollin Reeder, made a point of saying "no one is losing their job over this."
The case that shows what it's actually for happened at Sentara's Norfolk hospital. A physician, Dr. Colin Findlay, was treating a patient whose heart failure wouldn't come under control and suspected the patient simply wasn't taking their medication. Regard surfaced something more specific: the patient's hypothyroidism medication had been paused, and Findlay confirmed it should be resumed. That's the shape of the win worth noticing. The AI didn't decide the care. It read a pile of history faster than a human on a night shift could and handed a doctor a catch the doctor then acted on.
Why this matters: Dr. Findlay's save is the honest version of the clinical-AI pitch, a tired doctor getting one more good catch on a night shift, not a dashboard replacing anyone. That's the frame to keep, because the same deployment arrives with a number that isn't yet real: the projected staff-hour savings are a forecast from pilot data that Sentara's own CHIO says is unconfirmed. We've tracked medical AI from the lab results, the Nature studies where a system matched or beat physicians on tidy written cases, and the move that matters here is that this one left the lab and reached the bedside across a whole hospital system, with a clinician in the loop on every recommendation.
Action this week: Ask whether your own hospital uses an EHR-reading AI like Regard, what it flags, and whether a clinician reviews every recommendation it makes, because the Sentara case shows the value is a human doctor acting on an AI catch, not the AI deciding care. Judge these tools on catches you can verify, the earlier sepsis and the paused prescription, and stay skeptical of the efficiency projections until they're confirmed. And if you follow Virginia policy, lean on your hospital board and lawmakers for disclosure and oversight rules now, because clinical-AI deployment is outrunning the rules governing it.
» What to watch this week
- Whether a clean LiteLLM release is confirmed and how many downstream machines pulled v1.107.0 on October 21. The exposure window was narrow, but a stealer that runs on every Python startup means the count that matters is dev boxes and CI runners, not just projects that import LiteLLM.
- Whether Proton publishes the written criteria for its AI re-interviews, or whether "consequential" stays undefined. A written rubric is the difference between a development exercise and a quiet layoff mechanism, and other employers are watching which way this reads.
- Whether any station commits to on-air disclosure that a host is synthetic as Entravision expands Coyotec to new markets. The norm is cheap to set now and expensive to claw back once audiences stop being able to tell.
- Whether Sentara confirms its projected time-savings with real data, and whether disclosure and oversight rules for clinical AI get set. The verifiable catches are already real; the efficiency forecast and the oversight rules are the parts still unsettled.
Tomorrow's signal lands here.