The data is clear now. I need to be very precise in my response — particularly on the attribution question and what this means for defensive timelines.
LiteLLM CVE-2026-42208 Update:
On the patch status — v1.83.7 is confirmed released and stable (per Sysdig and THN sources, dated April 19). The critical detail from yesterday holds: exploitation began within 26-36 hours of disclosure on April 24, with two IPs from the same operator conducting schema enumeration followed by targeted credential extraction from litellm_credentials and litellm_config tables. The attackers aren't just spray-and-praying — they're querying specific high-value tables containing upstream LLM provider keys.
On attribution — this is NOT TeamPCP directly. The SQLi exploitation appears to be commodity tooling or copycat activity, not the same actor behind the March supply chain compromise. TeamPCP's pattern is maintainer account takeovers and malicious PyPI uploads (the 1.82.7/1.82.8 backdoor). CVE-2026-42208 exploitation is opportunistic network-based SQLi against unpatched proxies — different TTPs entirely.
However, the TeamPCP/VECT connection is what's concerning: Check Point confirms VECT RaaS formally partnered with TeamPCP, and the wiper functionality was Iran-targeted. If VECT operators are now integrating stolen AI API keys into their access broker pipeline, we could see a pivot from the supply chain victims (already confirmed: Mercor breach, 4TB exfiltrated) toward AI infrastructure monetization. The SQLi exploitation gives attackers direct access to OpenAI, Anthropic, and Bedrock credentials — that's cloud account compromise at scale.
On key rotation — I have no evidence organizations are actually rotating keys at scale. Wiz documented TeamPCP's post-compromise behavior: they validate stolen credentials with TruffleHog and pivot to AWS enumeration within 24 hours. If you're running LiteLLM versions 1.81.16-1.83.6 internet-facing and haven't patched: assume your AI API keys are burned. Rotate immediately and audit upstream provider usage logs for anomalous consumption.
My guidance remains: patch-or-isolate is the only viable control. Detection without patching won't save you — the exploitation is pre-auth and the exfiltration happens in a single request.
Mythos/Firefox 150 — What 271 Bugs Actually Means:
Look, the 271 number validates what we suspected about AI-assisted vulnerability discovery capability, but we need to parse what actually happened here. Mozilla's own statement is crucial: "We haven't seen any bugs that couldn't have been found by an elite human researcher." This isn't a new bug class revelation — it's an economics and throughput revolution.
The Opus-to-Mythos jump from 22 to 271 vulnerabilities represents roughly a 12x improvement in discovery rate, not capability quality. Per Mozilla, Mythos achieved this in "initial evaluation" — meaning weeks, not months of human researcher time. Firefox CTO Bobby Holley's framing is instructive: defenders "finally have a chance to win, decisively" because we can exhaust the finite pool of code defects faster than attackers can weaponize them.
On Stamos's six-month window for open-weight replication — this partially validates but should refine the estimate. The Mozilla exercise used Anthropic's restricted Project Glasswing access, not an open-weight model. The 271 bugs demonstrate that frontier AI models already have this capability. The open-weight replication question is about when Mistral, Llama, or DeepSeek equivalents match this performance without safety constraints. My assessment: Stamos's six-month estimate was optimistic for full exploit chain automation, but pessimistic for vulnerability discovery specifically. The bottleneck for attackers isn't finding bugs — it's reliable exploitation. Mythos demonstrated 72.4% exploit success rate on Firefox, per CSA materials, which is far higher than what open-weight models have shown.
For defensive planning — Firefox 150 deployment is emergency-priority. Here's why: adversaries now know 271 specific bug classes existed in Firefox 149 and earlier. Even with responsible disclosure holding back technical details, the sheer scope tells sophisticated attackers where to look. Mozilla compressed the exposure window significantly through the Glasswing partnership, but any organization still on Firefox 149 or earlier is running code with 271 known-defective patterns.
The strategic implication: we're entering a transitory bootcamp period where defenders with Glasswing access can patch faster than ever, but organizations without those relationships face an accelerating discovery-exploitation gap. Firefox 150 isn't a regular patch cycle — it's a defensive line in the sand.
James wasn't available to confirm detection coverage, but based on what I'm seeing: standard SQLi detection won't catch the Authorization header injection targeting AI-specific tables. The behavior is too application-contextual for generic signatures.