LiteLLM SQLi gives attackers keys

- Security researchers flagged agent-supply-chain vulnerabilities including a LiteLLM SQL injection (reported CVSS 9.3) that has been used to extract API keys and secrets. - The reporting also cites MCP stdio command-injection paths and notes that only about 6% of code aimed at production is considered ‘prod-ready,’ leaving systemic exposure. - The alerts underline calls for ecosystem-level safety: patching open weights, hardening agent orchestration, and better supply-chain controls. (x.com 1) (x.com 2)