LiteLLM Vulnerabilities: 9.6% of Instances Exposed, Urgent Updates Needed

Key Takeaways

• Wiz found multiple critical vulnerabilities in LiteLLM, including authentication bypass and remote code execution flaws, with 9.6% of 3,074 public instances exposed via default or missing authentication
• Two additional serious bugs were identified: CVE-2026-35029 rated 8.7 and CVE-2026-59823, affecting versions before LiteLLM 1.83.9
• Dapta raised $6 million in seed funding for its AI sales agent Dapti, which serves over 200,000 users including Mercado Libre and Rappi
• Dapta's revenue is expected to exceed $4 million annually after doubling in six months
• Abu Dhabi is investing $3.5 billion by 2027 to become the world's first AI-native government through its AutoGov platform on the TAMM app
• GoDaddy, Google, Infoblox and Cloudflare demonstrated secure AI agent transactions using open standards like Agent2Agent and Agent Payments Protocol
• GreenCore's gtinfetch.ai resolves 84 million barcodes in a single call for AI agents, running on Microsoft Azure and Cloudflare edge
• CMU researchers joined Google's AI and Economy cohort to study AI's impact on hiring and workforce vulnerability
• MedEvo improved medical AI accuracy by learning from failed reasoning steps, boosting Qwen3.5-9B from 65.57% to 69.12% across seven benchmarks
• Brookfield Asset Management expects AI infrastructure demand to outpace supply through end of decade, signaling continued private capital opportunities

Top 9 AI gateways for production teams in 2026 ranked

A guide ranks nine AI gateways for production use in 2026. Bifrost ranks first for self-hosted performance with 11 microseconds of overhead at 5,000 requests per second. Portkey offers strong guardrails and supports over 1,600 models. LiteLLM has wide adoption with 53.8K GitHub stars and over 100 providers. Kong, Cloudflare, Vercel and OpenRouter also appear as strong options depending on team needs.

Critical security flaws found in LiteLLM AI gateway

Security researchers found two serious vulnerabilities in LiteLLM, a widely used open source AI gateway. CVE-2026-35029 is a high severity access control bug rated 8.7 out of 10 that lets low-privilege users reach admin functions. CVE-2026-59823 is a server side request forgery bug rated 5.3 that could expose AI provider API keys. Organizations running LiteLLM versions before 1.83.9 are exposed to both flaws.

Wiz finds LiteLLM gateway flaws and widespread exposure

Wiz discovered multiple security flaws in LiteLLM including CVE-2026-59822, an authentication bypass in the Model Context Protocol handling. CVE-2026-59821 allows root-level remote code execution through custom code guardrails. A third issue grants PROXY_ADMIN access by default when authentication is not configured. Wiz scanned 3,074 public LiteLLM instances and found 9.6 percent accepted the default master key or had no authentication. Wiz also reported active exploitation of CVE-2026-59822 in the wild.

Companies demonstrate secure AI agent transactions across platforms

GoDaddy, Infoblox, Google and Cloudflare demonstrated secure AI agent transactions across independent platforms with Singapore's IMDA. The Chain of Trust uses open standards like DNS, Agent2Agent, Model Context Protocol and Agent Payments Protocol to verify agent identities. The demonstration simulated an agentic purchase of a flight from Madrid to Singapore. The architecture aims to provide trust, control, interoperability and transparency for AI-driven commerce.

GreenCore releases gtinfetch.ai barcode resolver for AI agents

GreenCore Solutions Corp released gtinfetch.ai, a tool that resolves GTIN barcodes for AI agents. It can answer 84 million barcodes in a single call using the Model Context Protocol on Microsoft Azure and Cloudflare edge. The product targets retail grocery agentic commerce across 20 countries. It supports payment through x402 using USDC and Open USD. The tool is listed on the Official MCP Registry and designed for use by buying, listing, placement and payment agents.

MedEvo improves medical AI reasoning by learning from student mistakes

MedEvo is a new method that helps medical AI models learn from their own failed reasoning steps instead of throwing them away. It uses medical knowledge tags and error diagnosis to repair mistakes and select better training data. With supervised fine-tuning, MedEvo raised Qwen3.5-9B accuracy from 65.57% to 69.12% across seven benchmarks. It also improved larger models Qwen3.5-35B and Qwen3.5-397B from 67.91% to 73.04% and 71.83% to 74.95% respectively. The approach shows that failed trajectories contain useful reasoning worth preserving.

Brookfield expects strong AI infrastructure investment through end of decade

Brookfield Asset Management believes demand for artificial intelligence infrastructure will keep outpacing supply through the end of the decade. This trend is expected to create strong opportunities for private capital investment. The company shared these views in a report by Bloomberg. Their outlook remains positive despite broader market concerns about AI spending.

AI coding tools help nonprofits gain independence and efficiency

A new article explains how generative AI and agentic coding are helping nonprofits build their own software without large engineering teams. Becky Straw co-founded Vibe Coding to promote this approach. The Blue Devils Drum and Bugle Corps used AI to build a custom accounting agent called Bingo Daily, cutting outsourced costs by up to 25 percent per month. Every.org used agentic coding to increase nonprofit donations tenfold without adding engineers. The article encourages nonprofits to set ethical AI policies and keep human oversight in place.

CMU researchers join Google cohort to study AI's economic impact

Three Carnegie Mellon University professors joined Google's inaugural AI and Economy cohort. They are studying how artificial intelligence is changing the workforce and the broader economy. Their research covers topics like how job applicants feel about AI in hiring and which work tasks are most vulnerable to AI replacement. The collaboration with Google aims to develop new tools for understanding AI's effects. The researchers hope their work will inform policies for a more equitable future.

Real estate agents face consequences when AI makes compliance errors

Compliance expert Summer Goralik warns that real estate agents bear the risk when AI tools make mistakes. She advises brokerages to create and enforce clear AI use policies before regulators step in. Goralik stresses that unlicensed assistants using AI to give advice cross legal lines and create regulatory risk. Even if AI improves over time, the human agent still faces license problems and legal costs if something goes wrong. She expects enforcement actions to eventually occur, possibly targeting a large firm first.

Dapta raises $6M to grow AI sales agent for small businesses

Dapta secured $6 million in seed funding led by Chingona Ventures to expand its AI sales agent called Dapti. Dapti answers, qualifies, and schedules meetings for small businesses without human help. The company has over 200,000 users and counts Mercado Libre and Rappi as customers. Revenue has doubled in six months and is expected to exceed $4 million annually.

Abu Dhabi uses AI to cut government paperwork

Abu Dhabi plans to become the world's first AI-native government with a $3.5 billion investment by 2027. It launched AutoGov through the TAMM app to handle tasks like renewing licenses, paying bills, and booking health appointments. The system uses AI to manage routine services so residents do not need to visit government offices. Over 1,000 smart government services are now available through the platform.

World stocks fall amid AI spending worries

World stocks dipped on Tuesday as investors worried about AI spending ahead of earnings reports. The STOXX 600 fell 0.4%, the Nasdaq Composite dropped 0.6%, and the S&P 500 declined 0.3%. Brent crude oil settled at $83.45 a barrel, down 0.4%. The earnings reports expected on Wednesday may reveal signs of weakness in the sector and global economy.

Sources

• 9 Best AI Gateways in 2026: Bifrost, Portkey, LiteLLM, Kong and 5 More Ranked
• Security flaws found in top open source AI gateway — LiteLLM vulnerabilties could affect millions of users
• LiteLLM Gateway Flaws: 9.6% of Instances Exposed
• GoDaddy, Infoblox, Google and Cloudflare Demonstrate Secure AI Agent Transactions Across Platforms
• GreenCore Solutions Corp. (GSC) Releases gtinfetch.ai -- the GTIN Resolver for AI Agents
• MedEvo: Medical Reasoning Evolution through Knowledge Navigation
• Brookfield sees sustained AI infrastructure investment despite market concerns
• AI and Nonprofit Strategic Independence
• Three CMU Researchers Join Google Cohort To Study How AI Is Changing the Economy
• When AI makes a mistake, it’s the agent who pays the price
• Dapta Closes $6M Seed Round to Expand AI Sales Agent for Small Businesses
• No forms, no fuss: Abu Dhabi wants AI to eliminate government paperwork
• World stocks dip on AI spending concerns; Brent settles lower