DeAI Daily Brief — 22 October 2026

Today in DeAI: LiteLLM's compromised release, OpenAI's models headed for Google Cloud, NVIDIA's confidential bare-metal compute, and llm-d 1.0.

LiteLLM 1.107.0 shipped a credential stealer and a RAT

Version 1.107.0 of LiteLLM, the open-source proxy that holds provider API keys for self-hosting teams, published on October 21 with an infostealer and remote access trojan in the PyPI wheels and official Docker image. The malicious artifacts were live under three hours; LiteLLM says anyone who installed or ran them should assume compromise and rotate every credential the host could reach. Wiz reports stolen AWS credentials being abused about 4.5 hours after exfiltration. Why it matters: the gateway is the single place where every provider key in a self-hosted stack lives, so a compromised install crosses every provider boundary at once. (LiteLLM incident report) — our full coverage

OpenAI models are coming to Google Cloud's Model Garden

OpenAI announced on October 21 that its frontier models and Codex workflows will arrive on Google Cloud's Model Garden, transacted through Google Cloud Marketplace, with general availability "in the coming weeks" and enterprise private preview at announcement. The Decoder notes Google Cloud becomes the first major platform carrying Gemini, Claude and OpenAI models side by side. Why it matters: distribution, not model quality, is the story — the largest closed lab is plugging into the largest hyperscaler's existing procurement pipeline. (OpenAI)

NVIDIA announces Confidential Bare Metal at GTC Berlin

NVIDIA's confidential-computing portfolio now includes Confidential Bare Metal, hardware-backed isolation for model weights and customer data on dedicated Grace Blackwell NVL72 and HGX/DGX Rubin NVL8 systems, with the OpenShell Reference Architecture and DSX OS announced October 21. Why it matters: bare-metal confidential compute attacks the core objection to hosted inference, that the operator can read your prompts and weights — though the hardware support claims are NVIDIA's own, and no independent attestation audit exists yet. (NVIDIA) — background: how TEE-based private inference works

llm-d 1.0 ships as a CNCF Sandbox project

The Kubernetes-native distributed inference stack llm-d reached 1.0, announced at PyTorch Conference by Google, Red Hat and IBM with more than 500 contributors. It coordinates vLLM and SGLang servers with cache-aware routing, tiered KV cache and priority flow control; Google's self-reported TPU benchmarks show an 85% cut in time-to-first-token and 2.4x throughput versus plain Kubernetes Services. Why it matters: the routing intelligence that used to be hyperscaler-internal is now something a self-hosting team can run on its own cluster. (Google Cloud)

Also today

Eternal (formerly Zomato) confirmed Dark.ai, a privacy assistant on fine-tuned open-weight models with claimed end-to-end encryption (CNBC-TV18) — our PULSE coverage. Recursive shipped Flint, an Apache-2.0 40B MoE coding model for local agentic coding (Hugging Face) — our PULSE coverage. Brave Leo's TEE-backed private inference deployment from October 15 remains the week's anchor architecture for hardware-attested inference.

Watching tomorrow

LiteLLM's next incident-report update, and whether the investigation confirms how the attacker reached the internal deployment that leaked the GitHub tokens.