LiteLLM was found buried with malware in the Depedency.

An AI with millions of users like LiteLLM has been found embedded with malware in the Depedency where the AI itself is active.

Artificial intelligence or AI, especially the large language model (LLM or Large Language Model), has facilitated many different tasks, but hackers have implemented it in ways that many people might expect.

According to a report by the Techcrunch website, an abnormality has been detected on an LLM-based AI called LiteLLM under the company's development, an open source project that allows users to access up to 100 models of AI tools, making it so popular that it has 3.4 million daily users. It has also been reviewed in up to 40 thousand stars on GitHub, and thousands of forks, although it has many advantages, but there is a researcher from FutureSearch, a company that provides services. The AI Agent, to help with web research, has detected that the Dependency extension of this AI tool has malware code inserted. Dependency means that software associated with this AI will also be affected. This malware has been verified and found to be capable of stealing login codes from both AI and related software. This malware is highly dangerous.

But by coincidence, such researchers were able to detect this malware because after downloading the AI tool on it, it automatically shut down the researcher's machine due to a bug inside the malware that resulted from the poor coding of the hackers behind it. After the machine was shut down, the researchers tried to determine why it eventually led to the malware being detected.

After the malware was detected and the researchers reported the detection back to the developer of this AI tool, the developer actively investigated and corrected the problem. In this case, there were people who were deeply skeptical of the transparency of the developer of this AI tool, because the developer claimed on the website that it had received high-standard certificates like SOC2 and ISO 27001. But there were people who detected that the developer was using the company that issued the certificate as a startup called Delve, which has a history of alleged use of fake data to lie to customers about its credentials. The company, as well as hiring auditors, signed a rubber-stamp audit and immediately issued certificates, making it considered that the certificates were fake. Delve immediately denied the allegations, and the management of the LiteLLM project did not comment on the allegations.

How will the associated malware cases and reservations end? Ask interested parties and people who have used them to follow the news closely.

# Trending # Lemon 8 Howtoo # lemon 8 diary # litellm # freedomhack