---
title: "LiteLLM supply chain attack, Block’s Dessa, and two small models"
description: "The LiteLLM supply chain attack began with a master key nobody revoked. Malicious 1.107.0 was on PyPI for about two hours. Dessa and two small models too."
canonical_url: https://www.oguzhan.co/litellm-supply-chain-attack-block-dessa-nanbeige/
author: "Oğuzhan Koçaklı"
author_url: https://www.oguzhan.co/about/
date_published: 2026-10-26T06:57:36+00:00
date_modified: 2026-10-26T06:57:40+00:00
language: en
translations:
  tr: https://www.oguzhan.co/tr/litellm-tedarik-zinciri-saldirisi-block-dessa-nanbeige/
---

# LiteLLM supply chain attack, Block’s Dessa, and two small models

A compromised `litellm==1.107.0` sat on PyPI for about two hours on 21 October. According to LiteLLM’s [root-cause post](https://docs.litellm.ai/blog/security-incident-oct-21-2026-attack-chain) published on 23 October, the LiteLLM supply chain attack started from an Agent Platform master key flagged in May 2026 and never revoked. Over the weekend I read the two security posts, Block’s Dessa page, two new Hugging Face cards, and the Swedish press reports. Every story came back to where the trust boundary actually sits.

## 🔐 The LiteLLM supply chain attack started with a key that was never revoked

![Isometric five-step chain from a key on a public shelf through a leaking door, CI belt and release gate to a green package](https://oguzhanco.s3.eu-west-3.amazonaws.com/wp-content/uploads/2026/10/26065733/litellm-attack-chain-forgotten-key-to-pypi.webp)

*The chain in five steps: a key left in a public repo, a token leaked by an API, CI branches, a relaxed release gate, then poisoned wheels on PyPI.*

LiteLLM is a widely used open-source Python gateway for calling many LLM providers. On 21 October, seven wheels of malicious `litellm==1.107.0` hit PyPI between 11:39:51 and 11:40:13 UTC, followed by Docker Hub and GHCR at 11:46:56 UTC. According to LiteLLM’s [incident post](https://docs.litellm.ai/blog/security-incident-oct-21-2026), those builds carried compiled malware that steals credentials and loads remote-code execution tools. PyPI quarantined them by 13:23 UTC. Docker Hub tags `v1.107.0`, `latest`, `main-latest`, and `main-stable` lasted until 14:20 UTC, while GHCR tags were down by 13:51 UTC. GitHub’s official v1.107.0 source tag had no malicious files. The build came from a lookalike org, `Berri-AI/litellm`, instead of the real `BerriAI`.

Oliver Jensen, Director of Security, and Mateo Wang published the root-cause account at 21:00 UTC on 23 October. LiteLLM calls it the canonical source of truth. On 27 May 2026, `opencode.json`, holding the master key of the internal experimental Agent Platform for self-hosted cloud agents, was committed to public `LiteLLM-Labs/lite-harness`. The commit was force-pushed over and the key flagged for revocation, yet it was never revoked.

On 10 October, that key called `GET /api/v1/managed_agents/agents?limit=100` and returned every managed agent config, including an un-scoped GitHub CLI OAuth token belonging to one of the two GitHub organization owners. LiteLLM notes that GitHub CLI tokens are created after 2FA and skip GitHub’s sudo-style re-auth for sensitive actions. Throwaway CI branches that night posted repo secrets to webhook.site and yielded two more maintainer tokens before the runs were deleted. More private-repo secrets left on 12 October.

On 21 October, branch protection rejected a push to the private release repo. Five seconds later, the owner’s token overrode it and pointed the release workflow at the lookalike fork. A second stolen maintainer token approved the production gate. Normally that gate needs a special account locked to a physical device in the office, but the rule had been relaxed earlier that week so any two engineers could trigger and approve releases for faster bugfix backports. I covered approval gates in my [24 October Claude Duet post](https://www.oguzhan.co/claude-duet-proactive-agent-approvals-limits/). A third token deleted workflow records, and `main` was force-pushed clean.

Outside user LidorMachluf opened issue #47826 at 12:06 UTC, catching the release within 20 minutes. Incident response began at 13:02 UTC. Enterprise customers on the private registry were unaffected. From the root-cause post: “This incident has provided a strong illustration of the risks associated with failing to rotate a potentially exposed key.” The 21 October update suspected tokens in internal deployment logs, whereas the root-cause post confirms the first token came from the Agent Platform API.

According to the incident post, you are affected if you installed unpinned `litellm` via pip from 11:39 to 13:23 UTC on 21 October or pulled those Docker tags from 11:46 to 14:20 UTC. Do not run pip first because starting Python re-runs `cook.pth` and `sitecustomize.py`.

- Delete `cook.pth` and `sitecustomize.py` from the shell before starting Python.
- Pin `litellm==1.106.2`, or rebuild the host from scratch.
- Rotate provider keys in the proxy database, master and virtual keys, the `DATABASE_URL` password, and the cloud role.

## 🎙️ What makes Block’s Dessa different from other voice AI?

![Coral and teal sound waves flowing in opposite directions and overlapping above an open silver laptop](https://oguzhanco.s3.eu-west-3.amazonaws.com/wp-content/uploads/2026/10/26065735/block-dessa-full-duplex-speech-laptop.webp)

*Full duplex means both sides can talk at once. Block says Dessa runs this locally on a MacBook Pro M4 Max or better.*

Block announced Dessa on Friday 23 October. According to the [Dessa page](https://block.xyz/dessa), it is a full-duplex speech-to-speech model: audio in, audio out, listening and talking at once, cutting in or giving backchannel cues like “yeah” and “got it”.

Block says Dessa was trained from scratch on human conversation only, with no text and no pretrained models, learning language from hundreds of times fewer words than LLMs. As far as Block knows, it is the first realistic live-conversation AI trained solely from human speech. Inference runs faster than real time on a MacBook Pro M4 Max or better, and training used one NVIDIA GB200 NVL72. A small lab inside Block built it, founded by former members of the Toronto startup Dessa, led by Ragavan Thurairatnam, and reporting directly to Jack Dorsey.

Dessa is not a product. There is no public API and no open-weight release. Early access goes to a small group of AI safety researchers for risks Block has not anticipated, and voice cloning or fraud worries explain why a human-sounding model starts closed. Block’s line on why text pipelines fail: “Imagine being in serious pain while a voice AI has no idea and just keeps going.” I read the page, which includes a clip of Dessa talking with OpenAI’s GPT-Live-1. [The Verge](https://www.theverge.com/ai-artificial-intelligence/1017906/jack-dorsey-block-dessa-ai-voice-speech) wrote on 23 October that some chats sounded “a little awkward and uncanny” and that the model once mistook a speaker for “Ronaldo”.

## 🧩 Two small open models for local agents

I read both Hugging Face cards over the weekend.

[Nanbeige4.3-33B](https://huggingface.co/Nanbeige/Nanbeige4.3-33B) is the Nanbeige team’s flagship teacher model, built to distill skills into smaller models like a planned Nanbeige4.3-3B. According to the card, at highest thinking effort on the same harness, it hits 80.9 on Terminal-Bench 2.1 (vs Qwen3.8-27B 73.0, Muse-Glimmer-30B 61.8, Gemma4-31B 47.2) and 65.5 on DeepSWE (vs Qwen3.8-27B 42.5). It trails on SWE-Bench Pro at 60.3 (Qwen3.8-27B 61.7), GDPval at 84.8 (vs 86.4), and GPQA Diamond at 89.5 (Gemma4-31B 91.3). Serving examples use 4-way tensor parallelism in SGLang and vLLM, so BF16 weights are for multi-GPU servers rather than laptops, though community GGUF quants exist. Muse Glimmer in the [22 October digest](https://www.oguzhan.co/deepseek-deepinfer-eagle-4-muse-glimmer/) targets single consumer GPUs.

NVIDIA post-trained [Nemotron 3.5 Bolt E4B](https://huggingface.co/nvidia/NVIDIA-Nemotron-3.5-Bolt-E4B-BF16) from Google’s Gemma-4-E4B-it, reaching GA on 23 October. It runs text in and text out with a conversational mode, a runtime thinking budget, a 4GB Q4_K_M build, and a DFlash drafter. NVIDIA says the OpenMDW-1.1 weights are ready for commercial use while the Gemma 4 base stays Apache 2.0. According to the card, Tau2-Bench is 55.10 against 38.50 for base Gemma 4 E4B-it, while Qwen3.5 4B scores 75.06 there.

|  | Nanbeige4.3-33B | Nemotron 3.5 Bolt E4B |
| --- | --- | --- |
| Parameters | 33B | 8B (4B effective) |
| License | Apache 2.0 | OpenMDW-1.1 |
| Context | 512K tokens | 64K in, 64K out |
| Built for | Coding and office agents | Local voice and device assistants |
| Headline claim | Terminal-Bench 2.1: 80.9 | IFBench: 63.79 (base Gemma 4 E4B: 42.84) |
| Released | 24 to 25 Oct (Hugging Face) | 23 Oct (Hugging Face, build.nvidia.com) |

## 🇸🇪 What did Sweden’s government offices block?

From today, Monday 26 October, work computers at Regeringskansliet (the Swedish Government Offices) block the ChatGPT and Claude web interfaces. [SVT](https://www.svt.se/nyheter/inrikes/ai-tjanster-sparras-pa-regeringskansliet) reported the move on 23 October and updated it on 24 October, citing [Sveriges Radio Ekot](https://www.sverigesradio.se/artikel/chat-gpt-och-claude-forbjuder-regeringskansliet). Staff are pointed to Microsoft Copilot, approved after a security review. An email to SVT confirmed the ChatGPT and Claude models remain reachable through the internal platform Intric. Similar blocks already run at Skatteverket and Statens institutionsstyrelse (SiS), while Kronofogden is considering one. The ban closes the consumer browser window while keeping the models available inside an approved door.

After reading the LiteLLM timeline, I want a list of which of my own tokens sit inside agent tools. I have not made that list yet.

## Sources

- [LiteLLM root-cause post](https://docs.litellm.ai/blog/security-incident-oct-21-2026-attack-chain)
- [LiteLLM incident post](https://docs.litellm.ai/blog/security-incident-oct-21-2026)
- [Block Dessa](https://block.xyz/dessa)
- [The Verge on Dessa](https://www.theverge.com/ai-artificial-intelligence/1017906/jack-dorsey-block-dessa-ai-voice-speech)
- [Nanbeige4.3-33B](https://huggingface.co/Nanbeige/Nanbeige4.3-33B)
- [Nemotron 3.5 Bolt E4B](https://huggingface.co/nvidia/NVIDIA-Nemotron-3.5-Bolt-E4B-BF16)
- [SVT](https://www.svt.se/nyheter/inrikes/ai-tjanster-sparras-pa-regeringskansliet)
- [Sveriges Radio](https://www.sverigesradio.se/artikel/chat-gpt-och-claude-forbjuder-regeringskansliet)