Every THE D[AI]LY BRIEF article on credential rotation — enterprise AI analysis, benchmarks, vendor comparisons, and ROI frameworks for technology and business leaders. Updated as new coverage publishes.
Nine AI developer platforms disclosed breaches in October 2026, and Wiz traced two stolen enterprise Bedrock keys from them to about 800,000 and 1.7 million calls. Rotate what those platforms held, hunt CloudTrail, and narrow your keys.
October 31, 2026 · 9 min read
LiteLLM 1.107.0 and its latest Docker tags carried a credential stealer for about two hours on October 21, and the attack survives uninstalling. Rebuild on 1.106.2 and rotate every key the proxy held as a security incident.
October 24, 2026 · 10 min read
Anthropic's September 2026 threat report shows attackers prompt-injecting an AI vendor's eval sandbox and LiteLLM-based wrappers to steal production API keys. Any harness or gateway that reads untrusted text while holding a key is a credential store — split, scope and cap those keys.
September 12, 2026 · 11 min read
Researchers decoded 315,320 encrypted reasoning blocks from 6,708 agent trajectories published to GitHub and Hugging Face, recovering 182 credentials and 367 PII artifacts. 64 of the 704 artifacts recovered from genuine user sessions never appeared in the visible chat history, which means transcript review provably misses some of what you have already published.
August 12, 2026 · 15 min read
npm removed ChainDrop's malicious versions within about two hours. The worm's second infection route never lived in a package — it lives in .claude/settings.json and .vscode/tasks.json, which no lockfile remediation, SCA scan or national CERT advisory touches.
August 7, 2026 · 11 min read