Meet GPT-Red: an LLM super-hacker OpenAI built to make its models safer - MIT Technology Review

Our security assessment of LiteLLM (v1.77.7), a widely used open-source LLM gateway, uncovered multiple high-impact vulnerabilities (tracked as CVE-2026-35029, CVE-2026-59823) which have been resolved as of LiteLLM version 1.83.9. The most significant issues stemmed from a missing authorization check on the /config/update endpoint, which allowed any authenticated user (including low-privileged accounts) to modify the proxy’s runtime configuration. This single flaw enabled arbitrary file read, administrative account takeover, and remote code execution via malicious Python modules loaded from cloud storage. A separate SSRF vulnerability in the “Clientside LLM Credentials” feature allowed attackers to redirect API calls and exfiltrate provider keys. These findings highlight that as AI infrastructure tools rapidly evolve, foundational security practices like proper access control and input validation remain essential.

IntroductionHistoric masonry minarets are slender, tall structures that embody cultural identity while remaining vulnerable to progressive deterioration and sudden hazards1,2. Aging mortar, material heterogeneity, environmental exposure, nearby construction, and seismic activity can introduce cracks, detachments, and out-of-plane deformations that are difficult to detect early, especially when access is limited and interventions must be minimally invasive. Structural health monitoring (SHM) for such heritage assets therefore benefits from non-contact sensing and data-driven inference that can operate continuously, localize damage, and provide interpretable evidence to support conservation decisions. For tall, slender masonry forms, monitoring is additionally complicated by geometric discontinuities (e.g., balconies, openings, and transitions), spatially varying material properties, and complex soil–structure interaction, all of which can concentrate damage and alter dynamic response over time3,4,5.